7 ms·
Hey HN - Privacy.com co-founder here. I'm really excited to share what we've been working on for the past year and a half or so. We've been neck-deep in paymen
by boling11 11y ago
Hey HN - Privacy.com co-founder here. I'm really excited to share what we've been working on for the past year and a half or so.
We've been neck-deep in payments stuff on the card issuing side (getting a BIN sponsor, ACH origination, etc), so happy to answer any questions on that front as well.
P.S. For new users, your first $5 donation to watsi.org is on us :)
- bisRepetita 11y agoThis sounds awesome. I really hope you will be successful!! What do you do when you get subpoenaed? Do you link all the accounts to the real identity? Lavabit-style exit?
- mirimir 11y agoYes, that's my question too :) I'm pretty sure that KYC trumps privacy, in this case :( Lavabit wasn't doing financial transactions. Openly, anyway.
- boling11 11y agoThank you! We do have to abide by US AML / KYC laws as we are working with a sponsoring bank. We plan on releasing transparency reports on a regular basis.
- mindslight 11y agoDo the anti-fungibility regulations and/or your sponsored relationship require you to preemptively submit your transaction information (eg card#->bank# mapping) for surveillance, or only in response to a specific court order? If the latter, what is your retention period? Do you have any plans to add batching+noise to foil global passive adversaries? For example, I opt to keep a running balance target of ~$50 and today's charge for $34.56 is debited as $31.37 a week later.
- dsl 11y agoMany virtual cards before you have ran into issues of being flagged as prepaid or single use cards and having their BINs blacklisted by merchants. How will you be combatting this?
- jasode 11y ago>ran into issues of being flagged as prepaid or single use cards I generate Citi's virtual credit card numbers every month for numerous online shopping payments and I haven't run into issues. It seems that it's not possible to determine if a card is a virtual number by parsing the digits.[1] Do you have other information stating that merchants know how to reject virtual cc numbers? [1]"As there is no way for a merchant to identify a card as virtual up-front," https://support.cybersource.com/cybskb/index?page=content&id=C1246&pmv=print&impressions=false https://support.cybersource.com/cybskb/index?page=content&id...
- dsl 11y agoCiti and BOA get away with it because they can allocate out of a large pool of BIN numbers that are otherwise regular use debit/credit cards. These guys will have to figure out how to get a similar "mix" to avoid being flagged as prepaid/single use. This was the issue that ultimately caused PayPal to kill the service they had that was almost exactly the same as Privacy.com.
- jasode 11y ago> will have to figure out how to get a similar "mix" to avoid being flagged as prepaid/single use. This was the issue that ultimately caused PayPal to kill the service That's fascinating. Perhaps PayPal killed it for multiple reasons because the (possibly biased) answer from a PayPal said not enough people were using it: "The one-time card numbers -- technically they were MasterCard virtual debit card numbers -- were discontinued as a public user-facing feature because they were not generating sufficient transaction volume and revenue to warrant further development." [1]https://www.quora.com/Why-did-PayPal-discontinue-their-one-time-credit-card-numbers https://www.quora.com/Why-did-PayPal-discontinue-their-one-t...
- jdc0589 11y agoIs the browser extension something you plan on requiring?
- boling11 11y agoNope!
- jeddawson 11y agoAre you planning anything for B2B? I’m working on an idea that will need to pay hundreds of vendors for the services they perform for our customers. We want to pay the vendors electronically where possible so having unique card numbers for each vendor would be a great thing. After looking at Privacy.com I want to take it a step further by generating a unique card number for each of our customers. We’d need higher spending limits and the ability to manage the cards via API. Other than that, what you’ve built sounds like a perfect fit for our use case.
- Havoc 11y ago>Privacy.com co-founder here Tell me about AVS please. Existing virtual card services have me covered on the virtual card front - both cost and (limited) privacy. I want something that gets me past the virtual card + AVS issue. All the virtual card providers seem to suck on this front...
- ChristianBundy 11y agoFor the confused: https://en.wikipedia.org/wiki/Address_Verification_System https://en.wikipedia.org/wiki/Address_Verification_System
- robryan 11y agoDo you want your address actually verified or a feature that makes AVS useless?
- Benjammer 11y agoWas curious about the motivations as well... I work at a small ecommerce company and we'd be effed without our AVS service to help with CC fraud.
- Havoc 11y agoCopy paste response >Do you want your address actually verified or a feature that makes AVS useless? Either is fine with me. I just want a virtual card (to protect my bank acc) that I can use in as many places as possible. Currently I've got a virtual card that only works like half the time...That's pretty underwhelming by any criteria.
- Havoc 11y ago>Do you want your address actually verified or a feature that makes AVS useless? Either is fine with me. I just want a virtual card (to protect my bank acc) that I can use in as many places as possible. Currently I've got a virtual card that only works like half the time...That's pretty underwhelming by any criteria.
- 11y ago
- moeffju 11y agoQuesting: Why is this US only, and why doesn't it say so right at the start? :(
- tuananh 11y agohmm i signed up only to find out about this.
- umeshunni 11y agoOut of curiosity - who is your BIN sponsor - Bancorp?
- andrewdietrich 11y agoSee the bottom of their website - Customers Bank
- ahmetaltay 11y agoAre you planning to support 3-D secure?
- wfunction 11y agoI had a general question about card numbers. Say there are 3E9 people on Earth, each with 3 cards. That's around 10 digits right there. There's 1 digit for checksum. I imagine you'd want to leave space for least 1000 financial institutions around the world, so that's another 4 digits. Which means you can only have 100 transactions per person. None of this takes into account the fact that the same people are issued way more than 3 card numbers either. So my question is, how are we not close to running out of card numbers? How is this not even a problem yet?
- umeshunni 11y agoThe short answer is that, in theory, we are running out. It's kept in check now by some amount of BIN & account number recycling by financial institutions. If you're curious about the number scheme, check out https://en.wikipedia.org/wiki/ISO/IEC_7812 https://en.wikipedia.org/wiki/ISO/IEC_7812
- codelitt 11y agoI don't believe we are that close to running out though, are we? Using the number scheme, this person calculated^1 that (assuming Amex starts issuing 16 digit cards) there would be 3*10^14 + 10^11 or 4.001e+14 possible combinations. [1]: https://www.reddit.com/r/theydidthemath/comments/3wj8eb/request_how_many_different_number_combinations/cxwmb7j https://www.reddit.com/r/theydidthemath/comments/3wj8eb/requ...
- ball_of_lint 11y agoThis actually wouldn't be much of a problem for privacy because they could just have x different cards and cycle them through and just keep very good books on who got what.
- ethagknight 11y agoThe date adds a few more digits, right?
- driverdan 11y ago> Say there are 3E9 people on Earth, each with 3 cards. You vastly overestimate the number of people with credit cards.
- tommynicholas 11y agoCongrats on getting to market with this! Super tough thing to do. Congrats!
- mkolodny 11y agoHow do your Privacy virtual cards affect your credit? Not at all?
- dogma1138 11y agoThey are prepaid cards so it's more like a debit card than an actual credit card. The money is transferred from your account before the card is issued / transaction go through so it's pretty much a charge card.
- alinspired 11y agoDo you plan integration with mint.com?
- ceejayoz 11y agoShouldn't be necessary, from my reading. The charges pass through to your checking account, so they'd already show up in Mint from that.
- cissou 11y agoI have one question: how? How can you fund my card at the time of payment, if you get my money through a wire transfer? By the time the money arrives, the merchant will have cancelled my purchase, no?
- homero 11y agoThey give you a hidden credit line
- carapace 11y agoI browse with JS disabled and your site is just a blank page for me.
- Laaw 11y agoShould probably turn JS on, then, if you want to browse the modern web.
- carapace 11y agoFool! This "modern web" you speak of is nothing without me browsing it. It is not I who am missing out! Nay! It is the "modern web" that is diminished by my non-browsing of it! They are punishing themselves! Why!? No matter. I shall browse on, without Javascript, safe in the certitude that I am only missing the content of people too foolish, ignorant, or uncaring to use HTML and CSS properly.
- marodox 11y agolol!
- nickpsecurity 11y agoPrivacy.com. Don't let them track you. I open it to find a totally blank page asking me to turn on malicious, surveillance-loving, code execution to view ("we promise") good content. (sighs) And, to "modern web requires Javascript" critics, modern life expects credit, web surveillance, Facebook, etc. That doesn't mean you have to support or force it on others. Let's look at it really quick to see if a HTML4 w/ CSS site could've handle it. Yep, we did more interesting stuff back in the "DHTML" days (eg dynamicdrive.com). So, it's a privacy site pushing risky, higher-overhead crap on us just for fun. Hypocrites. Alright, now let's look at the security. I should eliminate stealing a specific card or using malware on the machine to forge transactions. These are main attack vectors. Might mitigate the first. Looks like it will be vulnerable to the second. Admittedly, most methods are vulnerable to the second and those that aren't stay niche due to "inconvenience." So, still could be value in mass market where people get compromised anyway but want to knock out a common attack. The third risk is an unknown with some of the claims looking good on paper but to abstract to evaluate. Note: The split-keys between employees part on the security page is funny. It's a banking control for sure. I'll just let your imaginations work out how little protection it brings from hackers, management, or the government. ;)
- adrianmacneil 11y agoHow much did you guys pay for that domain? :)
- reagan83 11y agoAlso interested in this - you have an amazing domain name.
- seanp2k2 11y agoConsidering someone wanted 4 mil for [my fairy common first name].com a few months back when I was trying to get it, since I noticed that it has been parked for a while after the other guy who ran a neglected personal blog on it for years would never answer my emails, I would estimate quite a lot.
- boling11 11y agoWe didn't pay any cash. It's a long story, but there's probably a good blog post in this.
- munificent 11y agoI just want to note that your logo design is fantastic. Such a perfect combination of the name and concept. Really well done.
- comex 11y agoFYI, your site has a CSS bug: https://dl.dropboxusercontent.com/u/1237941/Screen%20Shot%202016-03-24%20at%207.01.23%20PM.png https://dl.dropboxusercontent.com/u/1237941/Screen%20Shot%20... Another: https://dl.dropboxusercontent.com/u/1237941/Screen%20Shot%202016-03-24%20at%207.03.10%20PM.png https://dl.dropboxusercontent.com/u/1237941/Screen%20Shot%20... The expiration date and CVV aren't fully visible - and for some reason clicking the "Open" button does nothing, so I can't close it.
- 4bpp 11y agoWhat, if any, data do you have to report to authorities or central databases by default, i.e. without receiving a specific warrant? Is there anything in that class you are not allowed to mention (but may be allowed to mention insofar as answering this question in the affirmative)?
- newman314 11y agoTwo questions: * Can I use your card to pay for FreedomPop? * Can I pay for your card using prepaid credit?
- darksim905 11y agoAm I reading comments right that this isn't work with an existing credit card, or say, paypal? So I have to give you my debit or bank account info?
- nobodyshere 11y agoI'm not really excited this is another US only service.
- tombrossman 11y agoWith a name like Privacy.com I was hoping to see your use of Google Analytics visitor tracking in your privacy policy: https://privacy.com/#privacy-policy https://privacy.com/#privacy-policy It isn't there, and disclosing it is mandatory under the Google Analytics T&C's (Section 7 here, it's crystal clear with the language "You must..." https://www.google.com/analytics/terms/us.html https://www.google.com/analytics/terms/us.html ) Can you please add it to your privacy policy? It's one of the first things privacy-conscious users look for when evaluating a website or service.
- boling11 11y agoWow - good catch. This was a huge miss on our part. We had it in the previous version, but it got overwritten (no excuse, our mess up). Anyway, thanks for bringing it up. We've pushed the updated terms.
- rawfan 11y agoAny plans for international expansion?
- ungerik 11y agoNot everyone who finds English content on the web lives in the US. Just wasted time because I thought I could use the service...
- sixdimensional 11y agoSeems like you guys could partner with companies like "Coin" - https://onlycoin.com/ https://onlycoin.com/ - having "soft" physical credit cards with dynamically issued numbers would be crazy.
- Eridrus 11y agoThis is actually what final is trying to do: https://www.getfinal.com/ https://www.getfinal.com/ Though Privacy's approach of being extension-first and launching first is probably the right one.