Let’s help Airbnb rebuild the bridge it just burned
blogs.law.harvard.edu
blogs.law.harvard.edu
I actually tried to go through their process and it was quite draconian. They ask for tons of stuff. Last 4 of SSN was one part, and they also asked questions about streets I lived on years ago, specifically, which county those streets are in. They must have a contract with someone who has a database of this kind of stuff.
But I got through that and was hung up on the last step, "Online ID", which requires a Facebook account (don't use it under my real last name), LinkedIn account (don't have one), or recording an introduction video (not possible while I'm sitting in a busy coffeeshop, also seemed like a pretty absurd ask). At this point I wanted to bail out but there was no "Cancel Reservation" button anywhere and they had my CC info hostage. So I had to close my whole account.
By the way, this was an account I had previously used to book an Airbnb place with no problems, and got a positive review from the guy. The surprise ID requirements struck me as manipulative, as if they knew if they'd asked for all this stuff before I booked a night, I wouldn't have used their site. So they pretended they were going to hook me up with a room, then sprung this out of nowhere.
(Then again, I recently answered the creepy questions for a friend of mine, so it's not protection against someone you know stealing your identity.)
I don't know why Airbnb needs to know your identity, but I could come up with some reasons. Imagine someone signs up under your name as a host, and their first guests have their laptops stolen. Your name is going to appear on that police report, and that's a pain for you. If the whole fake identity scam can be nipped in the bud, though, this won't happen as often, making life easier for more than just Airbnb's users. I don't think that's a terrible thing.
In a business where you're having total strangers stay in your house, is it really an invasion of privacy to ask you to verify you are who you say you are? This isn't an online blogging service or something, after all.
Part of the complaint is that guests have been booking (and getting positive reviews) without such all-encompasing knowledge of said guest's personal history. Hosts have evidently been fine with this too. In other words, what problem is this change solving (because it's not solving the guest's problem and some hosts are arguing it reduces bookings for them).
If it were in the power of the host to ask Airbnb to hold additional information on guests, then the situation would be completely different. You could then decide for yourself how much knowledge you're willing to provide (as a guest) or how 'verified' you want your guests to be (as a host). That doesn't seem to be the case here.
It's obviously not that hard, because airbnb are verifying the answers. I'm guessing any identity thief worth their salt has a way to buy rows from that dataset at a cheap rate.
I wouldn't lean on that assumption for too much longer. It's becoming easier and easier for that to happen, especially when one naively gives out those random details to any form that pops up on their computer screen (...even if the creators of that form have a cool story about making amateur breakfast cereals).
The big question is: can Airbnb close those holes without significantly reducing the usefulness of their service?
I very much doubt that. Hospitality is an industry with a long history, lots of regulation and self-regulation (which is not just corrupt government protecting incumbents), and disrupting that means tackling a huge range of issues an liabilities which Airbnb heavily oversimplifies.
I expect an increase in regulatory intervention, horror-stories in the media, lawsuits and Airbnb becoming increasingly more bureaucratic and complex in an effort to handle that.
That kind of corporate lingo is what I expect from soulless corporations.
[EDIT]
To make it clear. She offered lots of suggestions on what other services they could use and instead of a personal "Thanks for that, we will investigate" they gave her the brush-off with an obviously automated email.
Pretty shoddy customer relations.
That sounds like something leaders of soulless corporations would do.
(EDIT: Source: Prior working relationship with the company. Fought "tooth and nail" against this Verified ID junk.)
Did not know that they arranged to give employees liquidity after the initial news.
>Brian and I have spoken at length and based on our discussions, I’ve learned some new items that have proven to me that everyone is paying serious and thoughtful attention to the needs of all shareholders including employees. Specifically, the company has developed a strategy about their next financing round where all employees who have been with the company for some length of time will participate in a structured liquidity program. While the details haven’t been finalized, I know Brian and completely trust that he will execute on his commitment.
http://allthingsd.com/20111002/airbnb-investor-chamath-palih...
2) The primary complaint is that Verified ID reduces the number of bookings. This is only a concern to people who are using AirBnB illegally-i.e., as an unregistered hotel--and thus depend on volume. The people using AirBnB for its proper purpose--occasional temporary "guests"--are largely unaffected by this.
As for #2, it remains to be seen I guess how much % drop in AirBNB bookings are caused by this. It will be some number, but obviously I think they're prepared for it. I don't think this has anything to do with "unregistered hotels".
You incorrectly assume here that the only people who rely on a high volume of guests are those who do so illegally. Many Airbnb hosts operate a vacation rental property that they own. And they often rely on the income that property generates. These people – the ones that often maintain the best vacation rentals Airbnb offers – face the most damage from a drop in bookings. And Airbnb should be very concerned about that.
My guess? They already tested it on a small subset of their users and it's working well. Furthermore, if they have a network of all verified and trusted users, the network is going to be incredibly strong.
edit: sp error
It sounds like the verification flow has some serious design/flow problems. If I'm an Airbnb host in a major city and I have an affordable and highly rated place, I'm likely to attract all kinds of guests: both sophisticated and unsophisticated. For example, the most frequented place on Airbnb in San Francisco has probably seen hundreds of guests from around the world: https://www.airbnb.com/rooms/33577
Different people are different. Not everyone actually has a government issued ID. This does not mean they are necessarily illegal or untrustworthy. I think many people are going to freak out about these requirements... not just people without IDs, but average people who find the process intrusive. Do I have to answer security questions and upload my ID when booking a hotel? No.
However, maybe Airbnb has already tested this on a smaller random set of their listings and proven it doesn't reduce bookings.
Actually, hotels don't require your actual identity. Many people like celebrities, public figures, some business travellers routinely provide fake information to hotels.
"Why can't the property owner check your ID?" Some Airbnb spaces don't have anyone physically present at the property when guests arrive. As for the others, it's not just the property owners who have to bear the risks involved, but also Airbnb. If you book a hotel on Priceline, rape the maid, and trash the room, Priceline gets zero blame. If you book an Airbnb, rape your host, and trash their house, Airbnb gets all the blame. Especially when it turns out you did all these things anonymously.
I was thinking more about this today... maybe it is just that Airbnb has such insane supply and demand that they can afford to make this move and still be massively successful. If they're able to have a network of all verified and trusted people, the implications are huge.
Before we get into arguments about the validity of libertarianism...I think it shouldn't be shocking that when a company becomes large (with more at stake), they have to act in ways that will be overbearing in comparison to what they were before.
The quoted complaint above could easily apply to, let's say, the Apple iOS store, in which decisions are made heavily in favor of playing it safe and clean. I would like to argue that I'm wise enough to make my own choices about downloading immoral/unpleasant apps...and I'm entitled to make that argument. However, I can't argue that this...ahem, proactive policy prevents a great many shit-fests that might otherwise arise were it not in place. And I really can't dispute that Apple so far been wildly successful in the app marketplace.
Likewise, from Airbnb's perspective, I can see why they've made the calculation that proactively preventing scammers is overall, a good business decision. Because a few disasters from slightly foolish customers is enough to doom the entire ship.
No, this is a ham fisted marketing initiative pretending to be about security. Why they didn't just buy 'likes' with coupons like every other scummy company out there, I don't know.
1. How long has your account been active?
2. Does your account have a human-like pattern of activity?
3. Do your social graphs overlap realistically? Are you Facebook friends with your LinkedIn connections?
Etc. It'd take an extremely patient scammer to fake that sort of data. It can be done, of course, it's not trivial.
Can we please please please stop with the 'anecdote of 1 = data' and 'I do it like this and so do my friends (who are self-selected to be as much like me as possible)' arguments. It does not matter what you do, nor does it matter what you think. Businesses have much more data on this than the vast majority of HN readers, and while it's nice to think that they're all stupid in the 'I am so much smarter' sense, it is most likely not true. If Airbnb had, over the course of testing their validation approach against the first let's say 1000 users found out that the majority had little to no overlap in their social graphs between social networks, do you think they would keep using it this way? Clearly the answer is no, which leads to the prima facie conclusion that your generalization of your own behavior to the population at large is flat-out wrong. I'm not saying there is no way it could be that indeed most people have little overlap, just that the evidence we have so far, plus some reasonable thinking, points to the other conclusion.
Of course, if you do have (or can point to) data (i.e., not anecdotes, not 'I think', but hard data, obtained in a methodologically sound way) to the contrary, that would be a valuable addition to this discussion. All these "I don't do it like that so it sucks!" replies are just noise, and that was (in a passive-aggressive way) one of the underlying points in my reply.
On the whole I agree with you. Until the bot I described actually exists, social profiles are a pretty good identity check. No reason not to use them whilst they're still worth something.
Besides which they have your credit card on file. Why not just match that up with the scanned in driver's licence / passport?
It stretches credulity to suggest Facebook and LinkedIn are better ID checks than reviews from paying AirBnB users, which is what AirBnB's position seems to be.
To note, the way airbnb has rolled this out is quite surprising (mandatory sampling of users, disrupting active reservations, etc). Starting to wonder if there are any decent competitors out there.
(1) been a well-reviewed AirBnB guest on multiple occasions;
(2) concluded transactions through them on more than one CC for those previous stays;
(3) linked my Facebook and LinkedIn profiles long ago.
Such verification questions can involve things like car loans from more than a decade ago, and on at least one of the questions I wasn't even sure I remembered the right answer.
Though I understand they have fraud concerns, I felt it kind of obnoxious to spring this new requirement on me in the middle of a trip, when I was depending on AirBnB working the same as before (and indeed as it had worked on my 1st AirBnB reservation of the same trip).
Had I been required to send a scan of some government ID, I'd have felt even more like they'd breached our prior understanding, without warning, at an inconvenient time.
And you thought DHS was bad! And you thought "regulations" were bad! Let's get rid of it all! Let's disrupt!
But now, Facebook decides to police jokes according to vague claims by special-interest groups [1] and AirBnB requires its users to do a little dance for them before they can use their services.
Democracy has a lot of flaws, but constitutional rights and democratically voted laws, and a functioning judicial system, and well-run government agencies (I know, I know) are several orders of magnitude preferable to petty policies that grow in the mind of the average "community manager".
[1] https://www.facebook.com/notes/facebook-safety/controversial...
In general, most of the critics seem to say one of the two:
1. I'm obviously trustworthy, just look at me.
2. I want to have choice, I want to decide whether to host someone unverified or not.
What people need to realize about trust in p2p marketplaces is that trust is irrelevant, it's the experience that matters. At the end of the day, it matters whether you get what you wanted, and if you didn't, well fuck, it must be Airbnb's fault. It's never the users fault. Think about it.
On eBay, people get scammed every day. Does anyone say "well, that's just the users fault"? No, everyone says "eBay is full of scammers, I will never do it again". Same with the AppStores/Software Downloads. It's mostly the user's fault for downloading malicious software, but the platform always gets blamed.
So what you do in this case, and what Airbnb is doing is to "clean" the platform, cause the last thing you want is to have another Methlab incident or become the next eBay
In many countries people don't use facebook. Linkedin is a joke anyway. Where they do they're not used to authing with it. Where they don't you may use local social networks but they're often anonymous or don't provide api as rich. There is also this huge problem with languages: how are you going to read korean id in hangeul? how are you going to link airbnb name in latin with social network name in cyrillic? do you seriously expect people to be able to record videos in english that can't then be used to ridicule that people (they're going to be public, right?)
In many cultures people are just averse of posting private information about them on the web.
In many countries people don't use facebook
It's just that after Facebook more and more turned up the creepy volume to - for me - intolerable levels I chose to "delete" my Facebook account and don't plan to re-activate it ever again.
If your business relies on me having a Facebook account (or a specific piece of hardware) then I guess I'm not in the range of your targeted customers and we will never, ever do business together.
If you offer an (even more inconvenient) alternative I'm probably fine with that. For example: If your mobile boarding pass doesn't work with my device and I have to print it at an airport kiosk I'm fine with that. If I must have an iPhone to fly with your airline then I guess it's just not meant that we do business together.
When I helped a friend get verified, we provided a photo of his driver's license and did that thing which Paypal also does where Airbnb makes two sub-dollar deposits or withdrawals (I forget which) to our bank account, and we have to prove the bank account belongs to us by telling Airbnb the exact amounts of the deposits or withdrawals.
EDIT: s/emailed a photo/provided a photo/
That sounds secure.
But the truth is, there are a lot of things we do online that require real, meaningful identity verification. You put your SSN and DOB in and the computer gives you a series of multiple-choice questions from items on your credit report. People are used to them. They work.
And at the least, why not offer the credit report ID verification as the backup, perhaps alongside this video? Seems to me it would really cover their bases: The free spirits who would sooner die than submit to a credit check can produce a video. The professional, 2-million-miler, harvard-law types wouldn't flinch at an identity check that they've done every time they opened a credit card or bank account or many investment accounts or used the US Treasury or IRS systems or a credit monitoring product or, the list goes on. There's just a nominal cost associated with these, and unlike applications for credit they do not impact a persons credit score.
I'm not sold, but maybe there's something to the reliance on Facebook and LinkedIn afterall?
Even if they actually didn't set out to get it (unlikely), I have no doubt at all that they'll abuse it once they have it. Rule #1: spammers lie.
But really, why do they need my LinkedIn? LinkedIn is something I do not use. At this point, I just auto-accept all contacts and never check it. I know Airbnb uses my Facebook connections to show my friends that I've stayed at a particular place. That, to me, is fine. But, most of my LinkedIn connections are random acquaintances. I asked a couple of my friends and it's the same for them: Facebook for closer connections, LinkedIn for garbage. I don't need my LinkedIn connections knowing all the Airbnb places I've stayed at.
I've stayed at 10+ Airbnb places and have perfect reviews. I also willingly (a couple weeks ago) uploaded my driver's license. Host now have a clear idea of me based on my license and past reviews. Do hosts really need to know my LinkedIn profile? Honestly, to me, it seems like Airbnb wants to build out its graph and social connections. Maybe not spam you, but the social connections feature is pretty powerful so I can see why they'd want more social connections.
I have more to say but this is getting long. My opinion on all this right now is that Airbnb is experiencing a supply/demand tilt (more demand than supply) and they can afford to weed out the "crappy" demand (even if it's my aunt using Airbnb for the first time).
This reminds me of all of the companies trying to compete against PayPal, who tell themselves and customers that "We'll do it better this time I swear!". I can't wait until they try to reach the size of PayPal and realize their whole business model is based solely on fraud prevention. Something not easily, dare I say possibly, solved by any algorithm.
This is also why I like 37Signals, since they let their customers outgrow their software. For every project manager that says "ugh basecamp doesnt do this, I need something else", 37Signals quietly says "see ya later, you'll be back in a year!"
Yes, some people are asking that they personally be allowed to take the risk of hosting unverified people. As AirBNB continues to grow, I understand and agree why they won't let you do it - more cases of drug parties or robberies could ruin their business, and your business isn't worth as much to them as their business.
But requiring (if I understand it correctly) one of Facebook, LinkedIn, or a video? Telling you this ~80% of the way through a booking process? Implementing it with no notification (so people currently on holidays suddenly bump into the requirements)? These are the bigger issue.
I doubt they will cancel the current implementation plan in order to rethink a new one. But improving upon it - in particular with additional ways to verify identity - seems important.
Is the uproar over the mandate that a random 25% of users are now required to go through verification?
A video? Who seriously thought that this was a good idea?
And in any case, they don't ask you for a Facebook or LinkedIn account to spam you with besides your ID and credit card.
But I've never been to a hotel that asked for an ID just to make a reservation. I use booking.com, which is perfect BTW, and they never asked for an ID.
So true and happens all the time.
These kinds of processes scare me mostly from a safety point of view, but also from a trust point of view. How do I know the person verifying my credentials on the other end isn't secretly funnelling my documentation off to a nefarious third party using it to get a loan in my name or steal my identity to commit a crime? This has trouble written all over it, surely there is another way? The step requiring LinkedIn or Facebook is just ridiculous, what if you don't use any of those services?
If a company like Airbnb wants to dig themselves a hole, why should it be up to us to help them get out of it? I won't be using the service any more because of these changes and I assume others won't either.
I am not even sure if I am legally ALLOWED to send a copy of my ID anywhere in my country.
The right answer to a request from a company asking for such information is "F.U., no".
http://www.gesetze-im-internet.de/pauswg/__14.html
(in German, obviously)
It says who is allowed to 'process' the relevant information from the document. Copying is not mentioned.
The German Wikipedia has a section on it: http://de.wikipedia.org/wiki/Personalausweis_(Deutschland)#K...
As mentioned in the article, it feels like increased verification requirements should be an option available to to the host rather than a universal requirement.
One important lesson learned: no one wants to record a brief video as a step of any verification process.
So would I reconsider using Airbnb now that they have Verified IDs? Probably not. The root of the issue is that I don't want strangers in my house while I'm asleep. Even if Airbnb has their info on file, they're still strangers to me.
This move likely alienates many of their core users, while offering no appeal to non-users like me. Perhaps there is another segment this appeals to -- users who are concerned about the possibility of petty crime, and who feel this would be a deterrent or would aid with legal recourse?
Tell that to my maximum 6 digit, no special characters bank web login pin.
They think they're unique but their business model is trivial to reproduce once they have alienated half of their audience.
As a user, I would much rather deal with the hassle of verified ID than do business with guests/hosts that are unverified.
1. Airbnb has every right to demand that its users get verified. 2. The way they implemented verification is suboptimal.
My read of the article/comments shows that most people disagree with #1.
Edit: And there are always people, especially in the US, against any kind of ID request, but they are missing the point, in my opinion.
So seems like this is a problem for a small % of users - while the majority who are not bothered just don't care enough to voice their opinion.
I go to hotels, hostels, couch-surf, etc; I know people who rent properties with varying degrees of seriousness and involvement, and couch-surfing hosts. I interact with people who do these things on every continent. Airbnb is ridiculously out of line; it's requiring more than authoritarian governments do, much less any of its competition.
Lately, my Russian friend was trying to do a last minute reservation via Airbnb and they asked for verification. Russian users do not have facebook, they use vk.com, and instead of linkedin they have moikrug.ru. So she had to use a local alternative (sutochno.ru). Lost money for Airbnb.
I mean, I don't see how you can go half way on this. Leaving the choice up to the host doesn't protect anyone. It's easy to say "hey, I don't want to bother with this.", but the minute something DOES go wrong, who are they going to blame? AirBnB.
They have to cover their ass, simple as that. It sucks, but we live in a litigious society that loves to transfer blame.
If you were in a position where you had to make a tough choice and disappoint some people to protect your family(or company), you'd do it too.
As far as data mining goes... what's new? Are there any massive scale online businesses that aren't looking for new ways to mine their users for marketing and business data? I don't like it either, but I can't say I didn't expect it.
The issue is that transgender people make up (I'm guessing and feel free to correct me if I'm wrong) < 5% of the general population. I would then assume that < 1% of the Airbnb population is transgender. That's a low enough number that it is more efficient for Airbnb to solve for those issues on a case by case basis rather than in code / process changes. Simple case of optimizing for the 90% instead of the 100% -- if that's offensive then I apologize but in my opinion it's justified in the near-term (maybe not in the long-term)
I'd just like to stress that this doesn't address all the issues brought up, since some of them require more time, but I'm happy to answer more questions if you leave a comment on my post.
We all hate Paypal for its overofficcious moneylaundering ID requests which, should its dBs be compromised could easily screw the finances of millions. Do we really want to give these people IDs?
I wonder how many bad incidents airbnb has facilitated? Searching for "airbnb robberies" seems to point to only one incident (San Francisco) where the victim blogged about it.
But generally we shouldn't expect to hear about crimes facilitated by airbnb. Neither the cops nor the victims have an incentive to publicize it.
airbnb may have paid out a lot in hush money and settlements.
So, while this new identity scheme is unwelcome and intrusive, it may be the only way forward for airbnb.