Comment by jrockway | Hacker News Reader

Comment by jrockway | Hacker News Reader

Parent Full thread

The "creepy questions" are a pretty standard identity verification scheme. If you ever open a bank or brokerage account online, you'll probably be asked these. They're used because they're simple and work reasonably well. Anyone can steal or guess the last four digits of your SSN or driver's license, but it's harder to learn random details of your life.

(Then again, I recently answered the creepy questions for a friend of mine, so it's not protection against someone you know stealing your identity.)

I don't know why Airbnb needs to know your identity, but I could come up with some reasons. Imagine someone signs up under your name as a host, and their first guests have their laptops stolen. Your name is going to appear on that police report, and that's a pain for you. If the whole fake identity scam can be nipped in the bud, though, this won't happen as often, making life easier for more than just Airbnb's users. I don't think that's a terrible thing.

In a business where you're having total strangers stay in your house, is it really an invasion of privacy to ask you to verify you are who you say you are? This isn't an online blogging service or something, after all.

"In a business where you're having total strangers stay in your house, is it really an invasion of privacy to ask you to verify you are who you say you are?"

Part of the complaint is that guests have been booking (and getting positive reviews) without such all-encompasing knowledge of said guest's personal history. Hosts have evidently been fine with this too. In other words, what problem is this change solving (because it's not solving the guest's problem and some hosts are arguing it reduces bookings for them).

If it were in the power of the host to ask Airbnb to hold additional information on guests, then the situation would be completely different. You could then decide for yourself how much knowledge you're willing to provide (as a guest) or how 'verified' you want your guests to be (as a host). That doesn't seem to be the case here.

The "creepy questions" -- in the USA at least -- are just another revenue stream for the three credit reporting agencies. They (or third party companies paying them for the data) pull data from your credit report and then ask multiple-choice questions based on the data. It's absurdly insecure given the large number of people who have subscription access to credit reports (landlords, car dealerships, employers, etc.). Even more ridiculous is that the questions are based on data that is often false. A scammer who applies for a credit card in your name provides a false address; that false address is added to your credit report and now can become part of the identity verification scheme. And of course the onus is on you to fix the bad data held by these companies.

I recently failed such an authentication. The system had bad data about someone they thought was my relative even though I have no relative by that name. I was asked three different questions about this "relative" and on all three said I dont know anyone by that name. In the end the agent administering the test told me I had failed the self identification. I was eventually able to talk her into putting in a manual override but the whole experience was disconcerting.

It's insecure against a motivated, targeted attack. It is on the other hand a bitch to automate, given a file of 10,000 stolen identities, which is probably the primary concern animating most uses of these services.

>but it's harder to learn random details of your life

It's obviously not that hard, because airbnb are verifying the answers. I'm guessing any identity thief worth their salt has a way to buy rows from that dataset at a cheap rate.

> but it's harder to learn random details of your life.

I wouldn't lean on that assumption for too much longer. It's becoming easier and easier for that to happen, especially when one naively gives out those random details to any form that pops up on their computer screen (...even if the creators of that form have a cool story about making amateur breakfast cereals).

Reply on news.ycombinator.com