6 ms·

Having happily used AirBNB in the past, I recently tried to book a stay in Toronto. They wanted a full photo of my passport or driving license to complete the b

Having happily used AirBNB in the past, I recently tried to book a stay in Toronto. They wanted a full photo of my passport or driving license to complete the boking. Looking a little deeper, not only did they outsource the processing, but when others had questioned them about it the response seemed a little noncomittal. With leaks and lapses of judgment ocurring daily I feel like it would be an identity fraud ticking timebomb to use AirBNB and other services like it, especially given the attitude they seem to attach to security. I know others on HN feel diferently. I took my business elsewhere.

osrec 9y ago
> I know others on HN feel diferently. Remember a lot of the people on HN work at these firms, and therefore defend them. For example, I've noticed if I say anything negative about Facebook, the up/down votes on my comments swing wildly; initially starting fairly positive (say +30) then back down to slightly negative (say -2). The voting pattern is certainly intriguing and unusual. Basically, what I'm trying to say is, if you feel something about a particular tech company, HN may not always be the best place to validate that opinion as bias does exist. Stick with your gut (as you have done)!
jacobr 9y ago
Most Bitcoin exchanges also require id/passport, I assume these checks are also outsourced. Not exactly comfortable to share my passport with a random stranger.
StreamBright 9y ago
Prime example why we need laws that would forbid companies to do verification using your passport and other documents containing personal information.
- chii 9y ago
  but then how would a company that need to verify your identity before providing you a service do so? I m talking about things such as transferwise.com (or, even airbnb, which, if i were a host, i want to know who i m hosting).
  - StreamBright 9y ago
    And the best way of verification is obtaining a copy of my passport?
- dalbasal 9y ago
  It's going the other direction. We're accumulating laws that (usually implicitly) requiring companies to do verification using your passport and other documents containing personal information. Online versions of the kinds of rule whereby hotels need a photcopy of your passport. We are tangentially getting privacy initiatives from a different set of regulators/legislators, but... well... they're not doing a great job.
  - GFischer 9y ago
    "Know your customer" anti money-laundering laws are growing more stringent. In the U.S. the Patriot Act made it even more mandatory: https://www.pwc.com/gx/en/financial-services/publications/assets/pwc-anti-money-laundering-2016.pdf https://www.pwc.com/gx/en/financial-services/publications/as...
- zAy0LfpBZLC8mAC 9y ago
  Identity verification using passports is not the problem. Identity verification by exclusively looking at pictures of passports is the problem. The point of a passport is to bind your legal identity (name, place you live, dob) to characteristics of your body (signature, face), so that people can then use it to verify that the body standing in front of them is for legal purposes the legal entity described in the passport. The point is that in order to check the identity, you compare the picture to the face, you compare the signature on the passport to the signature they write with you watching, so you then can be reasonably sure they are the person described in the passport. What happens nowadays is that people check whether someone can send them a picture of a passport, and if they can, then that is considered proof that the entity that sent the picture obviously necessarily must be the person described by the passport depicted in that picture. That's just completely broken logic and should simply not have any legal weight at all. It's as if your web browser checked that the server sends a certificate that matches the requested host name, but didn't check any signatures or anything to ensure they are indeed talking to the owner of that certificate and its corresponding secret key.
  - JadeNB 9y ago
    > Identity verification using passports is not the problem. Identity verification by exclusively looking at pictures of passports is the problem. I think another significant part of the problem is the fact that sending someone a picture of your passport means that they, and anyone with whom they choose to share it, thereafter permanently have a picture of your passport. For example, I would have no problem if I were somehow able to audit these companies' use of the passport data and to make sure it was used responsibly and deleted after use. (I would compare to the way that I see everything a customs officer does with my passport, but of course that's not really true, since I have no idea what processing is going on on their computer. However, whatever they've got on the computer comes from access to government databases, to which (hopefully!) private companies don't have access.)
    - garmaine 9y ago
      “Prove you are who you say you are by sending us your bank password. Oh, and we’ll keep it on file indefinitely.”
dalbasal 9y ago
Ultimately, there're competing requirements here: person verification & privacy. The requirements are partly AirBnB solving its own problems (like expensify in this case). Partially (substantially), these are "the man's"requirementsˆ. If a photo of your passport or whatnot is private information that must be kept secret, or else identity theft... well then it can't be sent to AirBnB en masse. Those two do not (easily) go together. Certainly not if it's AirBnB, uber and twelve other things every year. Mechanical turking the review is bad, but doing it internally is probably just as bad. Lots of people will have access to the docs, copies will be emailed around.. Over the last few years (and ongoing) there's been persistent attempts to regulate and change business norms such that transactions are de-anonymized. A lot of it under the heading of "AML." Even most AML has nothing to do with money laundering. The norms of validating customers for fraud prevention or other reasons are becoming a general business/regulatory norm, boilerplate practices. The specific implementations are half-hazard and often negligent.
- _red 9y ago
  I just had a case where I was locked out of an account because their backend couldn't send 2FA auth code to my phone. In order to unlock my account, they wanted me to provide "scanned copy of official ID", I refused. The basis of my refusal was: If your backend systems cannot send 2FA to my phone because of some unknown reason, why should I trust it to securely store my ID info? I told them I would rather remain locked out of the account and simply post the entire conversation on twitter for all to see. Within 5 mins she capitulated and suddenly "discovered another way she could unlock". There are numerous things that are sort of scary about that encounter. (Was my ID actually required? Threats to post on twitter change security requirements, etc)
  - dalbasal 9y ago
    I think we’re on the same page. Well.. This is inevitable if for internal or external reasons, something on the internet needs to verify your identity. Either (A) they live without this verification (B) we find some way of verifying or (C) every tom dick & harry has a dropbox folder full of people’s "scanned copy of official ID.” To me, it seems like “verifying people” in this manner is stupid. The whole premise is that there are documents that only I have. By sending the document to you, I show that only I could be me. Using this process widely breaks the premise. I know for a fact that several parties’ employees, contractors and such have scanned copies of my official ID …I sent it to them.
CaptainZapp 9y ago
Playing devil's advocate: Where is the problem? Or, what does a passport or id card contain, which should be kept secret? Your name? They have that anyway? A passport number? What could be done with it, except verifying that the passport is legit and not stolen? My height? Who cares? While I really think there's much too much shenanigans, which can be done with an (US) social security number and personal information I just don't see the same issue with identification. I'm happy, of course, to be educated otherwise. Disclaimer: i did upload a foto of my passport in ordet to rent an AirBnb in Sapporo.
- pjc50 9y ago
  Well, given an image of an ID uploaded to service A you could obviously use it as credentials to service B; someone else could reupload your ID in order to rent from AirBNB as you.
  - CaptainZapp 9y ago
    Thanks & fair enough. I really prefer a legitimate answer, like yours, as opposed to be voted down for posting a legitimate question.
- zAy0LfpBZLC8mAC 9y ago
  Either sending someone a picture of a passport is accepted as proof that you are the owner of the depicted passport, or having a picture of a passport is worthless. Choose one, and then explain why sending a picture of a passport to airbnb makes sense and security on their part doesn't matter.
- andyhmltn 9y ago
  >"Or, what does a passport or id card contain, which should be kept secret?" Well for one the passport as a whole can then be used to commit identity fraud or cloned on the black market.
- easytiger 9y ago
  Combined with some othe rpersonal info it can get you registered for the UK online tax portal etc
ixacto 9y ago
Yup. The surprise request for passport/id is exactly what caused me to delete my Airbnb account and cancel the booking that I had already made without the request for passport/Id. Airbnb you don’t get to pull this kind of unethical shit.
- ixacto 9y ago
  Airbnb employees not happy with my comment I guess, but it's true. I don't want to have to give you my passport before I can go stay somewhere that I already booked like 6 months ago.

osrec 9y ago

> I know others on HN feel diferently. Remember a lot of the people on HN work at these firms, and therefore defend them. For example, I've noticed if I say anything negative about Facebook, the up/down votes on my comments swing wildly; initially starting fairly positive (say +30) then back down to slightly negative (say -2). The voting pattern is certainly intriguing and unusual. Basically, what I'm trying to say is, if you feel something about a particular tech company, HN may not always be the best place to validate that opinion as bias does exist. Stick with your gut (as you have done)!

jacobr 9y ago

Most Bitcoin exchanges also require id/passport, I assume these checks are also outsourced. Not exactly comfortable to share my passport with a random stranger.

StreamBright 9y ago

Prime example why we need laws that would forbid companies to do verification using your passport and other documents containing personal information.

chii 9y ago
but then how would a company that need to verify your identity before providing you a service do so? I m talking about things such as transferwise.com (or, even airbnb, which, if i were a host, i want to know who i m hosting).
- StreamBright 9y ago
  And the best way of verification is obtaining a copy of my passport?
dalbasal 9y ago
It's going the other direction. We're accumulating laws that (usually implicitly) requiring companies to do verification using your passport and other documents containing personal information. Online versions of the kinds of rule whereby hotels need a photcopy of your passport. We are tangentially getting privacy initiatives from a different set of regulators/legislators, but... well... they're not doing a great job.
- GFischer 9y ago
  "Know your customer" anti money-laundering laws are growing more stringent. In the U.S. the Patriot Act made it even more mandatory: https://www.pwc.com/gx/en/financial-services/publications/assets/pwc-anti-money-laundering-2016.pdf https://www.pwc.com/gx/en/financial-services/publications/as...
zAy0LfpBZLC8mAC 9y ago
Identity verification using passports is not the problem. Identity verification by exclusively looking at pictures of passports is the problem. The point of a passport is to bind your legal identity (name, place you live, dob) to characteristics of your body (signature, face), so that people can then use it to verify that the body standing in front of them is for legal purposes the legal entity described in the passport. The point is that in order to check the identity, you compare the picture to the face, you compare the signature on the passport to the signature they write with you watching, so you then can be reasonably sure they are the person described in the passport. What happens nowadays is that people check whether someone can send them a picture of a passport, and if they can, then that is considered proof that the entity that sent the picture obviously necessarily must be the person described by the passport depicted in that picture. That's just completely broken logic and should simply not have any legal weight at all. It's as if your web browser checked that the server sends a certificate that matches the requested host name, but didn't check any signatures or anything to ensure they are indeed talking to the owner of that certificate and its corresponding secret key.
- JadeNB 9y ago
  > Identity verification using passports is not the problem. Identity verification by exclusively looking at pictures of passports is the problem. I think another significant part of the problem is the fact that sending someone a picture of your passport means that they, and anyone with whom they choose to share it, thereafter permanently have a picture of your passport. For example, I would have no problem if I were somehow able to audit these companies' use of the passport data and to make sure it was used responsibly and deleted after use. (I would compare to the way that I see everything a customs officer does with my passport, but of course that's not really true, since I have no idea what processing is going on on their computer. However, whatever they've got on the computer comes from access to government databases, to which (hopefully!) private companies don't have access.)
  - garmaine 9y ago
    “Prove you are who you say you are by sending us your bank password. Oh, and we’ll keep it on file indefinitely.”

dalbasal 9y ago

Ultimately, there're competing requirements here: person verification & privacy. The requirements are partly AirBnB solving its own problems (like expensify in this case). Partially (substantially), these are "the man's"requirementsˆ. If a photo of your passport or whatnot is private information that must be kept secret, or else identity theft... well then it can't be sent to AirBnB en masse. Those two do not (easily) go together. Certainly not if it's AirBnB, uber and twelve other things every year. Mechanical turking the review is bad, but doing it internally is probably just as bad. Lots of people will have access to the docs, copies will be emailed around.. Over the last few years (and ongoing) there's been persistent attempts to regulate and change business norms such that transactions are de-anonymized. A lot of it under the heading of "AML." Even most AML has nothing to do with money laundering. The norms of validating customers for fraud prevention or other reasons are becoming a general business/regulatory norm, boilerplate practices. The specific implementations are half-hazard and often negligent.

_red 9y ago
I just had a case where I was locked out of an account because their backend couldn't send 2FA auth code to my phone. In order to unlock my account, they wanted me to provide "scanned copy of official ID", I refused. The basis of my refusal was: If your backend systems cannot send 2FA to my phone because of some unknown reason, why should I trust it to securely store my ID info? I told them I would rather remain locked out of the account and simply post the entire conversation on twitter for all to see. Within 5 mins she capitulated and suddenly "discovered another way she could unlock". There are numerous things that are sort of scary about that encounter. (Was my ID actually required? Threats to post on twitter change security requirements, etc)
- dalbasal 9y ago
  I think we’re on the same page. Well.. This is inevitable if for internal or external reasons, something on the internet needs to verify your identity. Either (A) they live without this verification (B) we find some way of verifying or (C) every tom dick & harry has a dropbox folder full of people’s "scanned copy of official ID.” To me, it seems like “verifying people” in this manner is stupid. The whole premise is that there are documents that only I have. By sending the document to you, I show that only I could be me. Using this process widely breaks the premise. I know for a fact that several parties’ employees, contractors and such have scanned copies of my official ID …I sent it to them.

CaptainZapp 9y ago

Playing devil's advocate: Where is the problem? Or, what does a passport or id card contain, which should be kept secret? Your name? They have that anyway? A passport number? What could be done with it, except verifying that the passport is legit and not stolen? My height? Who cares? While I really think there's much too much shenanigans, which can be done with an (US) social security number and personal information I just don't see the same issue with identification. I'm happy, of course, to be educated otherwise. Disclaimer: i did upload a foto of my passport in ordet to rent an AirBnb in Sapporo.

pjc50 9y ago
Well, given an image of an ID uploaded to service A you could obviously use it as credentials to service B; someone else could reupload your ID in order to rent from AirBNB as you.
- CaptainZapp 9y ago
  Thanks & fair enough. I really prefer a legitimate answer, like yours, as opposed to be voted down for posting a legitimate question.
zAy0LfpBZLC8mAC 9y ago
Either sending someone a picture of a passport is accepted as proof that you are the owner of the depicted passport, or having a picture of a passport is worthless. Choose one, and then explain why sending a picture of a passport to airbnb makes sense and security on their part doesn't matter.
andyhmltn 9y ago
>"Or, what does a passport or id card contain, which should be kept secret?" Well for one the passport as a whole can then be used to commit identity fraud or cloned on the black market.
easytiger 9y ago
Combined with some othe rpersonal info it can get you registered for the UK online tax portal etc

ixacto 9y ago

Yup. The surprise request for passport/id is exactly what caused me to delete my Airbnb account and cancel the booking that I had already made without the request for passport/Id. Airbnb you don’t get to pull this kind of unethical shit.

ixacto 9y ago
Airbnb employees not happy with my comment I guess, but it's true. I don't want to have to give you my passport before I can go stay somewhere that I already booked like 6 months ago.