Ask HN: Would you send a photo holding your drivers license to rent a VPS?

KYC is actually a clever trick by the government to pass the buck to the banks to verify if transactions are illegal or not. The main reason is that when you are dealing with the government, you are innocent until proven guilty. Using the banks to money launder? It’s up to the government to prove it and bring charges or its business as usual for you.

With banks having that power, you’re guilty until you prove innocence. Haven’t committed any crimes? Doesn’t matter, you’re banned by default and after you provide ID, we’ll let you bank. Oh and if for any reason, we can ban you and you have no recourse. We won’t tell you the reason either. It’s a great way for the government to not actually go after the money launderers and give the keys of doing business to a select few.

I don't think KYC laws keep people un-banked. According to the Federal Reserve only about 5% of adult Americans don't have a bank account. KYC is relatively easy to comply with, about the same as getting a library card. But if a person has a history of writing bad checks or running up overdrafts they can't get a bank account. And some percentage of Americans don't trust banks and remain un-banked by choice.

Source for your claim of 55 million unbanked American adults? That's 21% of the 2020 US adult population, and four times higher than what the Fed reports. If America had 55 million potential customers banks would be tripping over each other opening new accounts at McDonalds.

I think my point was unclear ...

What I am saying is, there is no reason for other firms to perform KYC because it is totally redundant. The banks already have to do it and they have a better view of the transaction flow anyway.

Any KYC that your ISP might do would be both redundant and inferior to what your bank is already doing.

It is a waste of resources - and a drag on smaller businesses - to do this work twice.

I pay for a vps with a credit card, isn't this essentially the banking system doing the same thing?

That is what I'm thinking of, thanks for the context

agreed, I don't recall any large cloud or VPS provider asking for an ID.. maybe a French thing?

> Your logic is used by bad teachers in kindergarten to justify group sanction because of a single person's misconduct.

The rules we're talking about -- know your customer -- don't come from my logic. They got implemented specifically to fight terrorism and funding terrorism and money laundering (originally part of the Patriot Act, 2001). So yes, everyone got sanctioned because of the "misconduct" of a few people. Whether we agree with that approach or not governments often do exactly that kind of thing. It's the nature of governments and laws to apply rules to everyone at once, and frequently everyone gets "sanctioned" by laws that got written because of a few bad actors. I think about that every time I have to go through security to board a plane.

> I have never seen a bad actor driving rules against his own actions (exceptions exist).

I didn't write that the bad actors make the rules. Their actions lead to the rules, e.g. the rules get driven by the bad actors.

> You can decrease the likelihood of it happening, or mitigate the impact, e.g. by setting rules.

Rules tend to work both ways. Laws against drunk driving, to take just one example, seek to both decrease the likelihood of drunk drivers, and to mitigate the impact through enforcement and punishment, and through legal liability. KYC laws seek to do the same thing: prevent money laundering in the first place, and enable enforcement and punishment.

> Costs for executing these rules should be weighed against the benefits.

We could debate how the world should work all day long, but I'll stick with how it actually works.

> If a driver's license is public information, why would they ask for it?

I didn't write that licenses are public information. I wrote "nothing on a US driver's license is private information." See the difference? The opposite of "private" is not "public." Lots of people and businesses have access to that information. My photo and address may as well be public, anyone with a computer can find those. Driver's licenses are issued by states, with your implied consent to give all of that information and let them print it on a card. The invasion, if you want to call it that, happened when you voluntarily obtained the license. As you might expect, the US has laws around privacy of driver's license information:

https://en.wikipedia.org/wiki/Driver%27s_Privacy_Protection_...

So while not exactly public, that information isn't really private, either. Note provision 3 of the Driver's Privacy Act: "For use in the normal course of business by a legitimate business or its agents, employees, or contractors, but only to ... verify the accuracy of personal information." So a VPS provider or any other business needing or wanting to verify a person's identity can ask to see a license as a form of identification. You don't have to show it to them, but they don't have to take your business either.

My license has this information, none of which I think of as particularly private:

- State of issue

- Date of issue and expiration

- License number assigned by the state

- Photo of my face

- My full legal name from my birth certificate (a public record)

- My address at the time I obtained the license

- My date of birth

- My height, weight, hair, and eye color

- My signature - What kinds of vehicles I can legally operate

Anyone could find out almost all of that with Google. People put more private personal information in their Facebook and LinkedIn profiles.

> If it indeed is public, they don't need to ask for it, because sending it doesn't hold value.

Do you understand the difference between looking up someone's license information in a database, and doing what bar bouncers and banks and apparently French hosting companies do -- asking to see the license in your hands alongside your face? Do you think passports would work if you could just write down your passport number and tell the immigration agents to look it up, because they potentially can do that? The license has value as identification when someone can visually compare it to the person it belongs to, see that the person is in possession of the identification, and confirm at least some of the information on the license -- already vetted in some way by the state -- matches information the person gave. It's a kind of physical two-factor authentication.

> Them having the ability to send that information again, can be perceived as, or is, invasive.

Collecting driver's licenses and then "sending that information again" would violate the law I cited above. If I gave a photo of my license to a hosting company and could then prove they gave or sold that to some other company without my consent, I would have a cause of action in court.

Not the actor but Bourne's passport from the movie? Interesting.

Hetzner requires me to provide a photographed government ID.

A decade ago at the provider I worked at we’d routinely ask for id verification like this for accounts that tripped our fraud signal system.

it's not bizarre and totally makes sense from the perspective of the hosting company being used for nefarious purposes and not wanting to get shut down. tragedy of the commons and all.

Maybe, I don't have any real opinions on them, but wherever they are this is a step in the right direction with regards to that.