2 ms·

Ask HN: Validating user's real identity

5 points by SoftwareMaven 16y ago

My startup needs to be able to validate a user's real identity. Similar to personal digital certificates, we may have multiple levels of trust. I'm wondering what methods you may know of to validate a user's real identity. These may range anywhere from charging a credit card through a notary public's signature. In particular, I'm looking for methods I could automate in code. :) Thanks.

maxdemarzi 16y ago
Credit Card would give you the user's name.... but John Smith isn't John Smith, he just happens to have the same name. John Smith #2 could also add John Smith #1 address to his authorized credit card addresses, but that's a malicious edge case. Old school way of opening a back account online was, you verified yourself online with something YOU KNEW (account number and last debit/credit on the account). Then we'd snail mail you a letter to your known address (something WE KNEW), have you sign it and send it back. -- You could skip the mail it back by having them input a code you mail them. Also things get messy if you have a "jr" in the house. John Smith and John Smith Jr. may both use John Smith and live in the same house. How sensitive is the data and how regulated is your industry would determine the lengths you have to go to.
- e1ven 16y ago
  You'd think, but they actually don't check the name on a Credit Card. The Mailing method is a good one, but to be 100% sure, you'd need to send it Certified Mail, Restricted Delivery. ~ $13/letter, but it IS the person you're looking for.
e1ven 16y ago
So it turns out, it's actually very hard to do this ;) I'm launching a new site which relies on people's real names in the next week or so, so this is something I've done a bit of research on. Here's the bad news- Credit Cards don't check people's names. Really! You can buy something and use the name "Elvis Presley" on an online store, and no one will ever know. I've talked to Authorize.net, PaySimple, PayPal- No one checks name. The banks don't support it. Here's the good news- There are companies who can do it for you- RSA, Verisign, Equafax, and a half dozen others can do a background check on people for you, and as part of that they can verify their name. Get ready to pay, though, and it's not cheap. Quotes range from $500-2000/month, plus $1-$5 per lookup. These engines are normally used by debt collectors to come after you, if you're behind on a payment. They'll also need to verify your Company Bank Account, founding Documents, and have a personal guarantee, since it's sensitive information. There are ways to do it without going through that, though- The easiest way is to send a letter to their house. If you send "Certified Mail, Restricted Delivery", then it has to be signed for, and it has to be signed for by the person in question. Not only does this make it difficult for them to fake it, if someone else signs it for them, it's a Federal Crime! You could send out letters with a one-time code on each of them, and then have people use that to Verify the registration. I'd love to talk more about your project, I may be able to help you out, since I just went through the work of building it, using the Credit Companies ;) Email me. cdavis@darkenedsky.com
- user24 16y ago
  You're right about the lack of name checking. I think it's due to people being unable to accurately spell foreign names when taking orders over the phone. Tricky problem. In fact if you solve it nicely, there's probably a good argument to shift your startup's focus to doing that.

5 points by SoftwareMaven 16y ago

maxdemarzi 16y ago

Credit Card would give you the user's name.... but John Smith isn't John Smith, he just happens to have the same name. John Smith #2 could also add John Smith #1 address to his authorized credit card addresses, but that's a malicious edge case. Old school way of opening a back account online was, you verified yourself online with something YOU KNEW (account number and last debit/credit on the account). Then we'd snail mail you a letter to your known address (something WE KNEW), have you sign it and send it back. -- You could skip the mail it back by having them input a code you mail them. Also things get messy if you have a "jr" in the house. John Smith and John Smith Jr. may both use John Smith and live in the same house. How sensitive is the data and how regulated is your industry would determine the lengths you have to go to.

e1ven 16y ago
You'd think, but they actually don't check the name on a Credit Card. The Mailing method is a good one, but to be 100% sure, you'd need to send it Certified Mail, Restricted Delivery. ~ $13/letter, but it IS the person you're looking for.

e1ven 16y ago

So it turns out, it's actually very hard to do this ;) I'm launching a new site which relies on people's real names in the next week or so, so this is something I've done a bit of research on. Here's the bad news- Credit Cards don't check people's names. Really! You can buy something and use the name "Elvis Presley" on an online store, and no one will ever know. I've talked to Authorize.net, PaySimple, PayPal- No one checks name. The banks don't support it. Here's the good news- There are companies who can do it for you- RSA, Verisign, Equafax, and a half dozen others can do a background check on people for you, and as part of that they can verify their name. Get ready to pay, though, and it's not cheap. Quotes range from $500-2000/month, plus $1-$5 per lookup. These engines are normally used by debt collectors to come after you, if you're behind on a payment. They'll also need to verify your Company Bank Account, founding Documents, and have a personal guarantee, since it's sensitive information. There are ways to do it without going through that, though- The easiest way is to send a letter to their house. If you send "Certified Mail, Restricted Delivery", then it has to be signed for, and it has to be signed for by the person in question. Not only does this make it difficult for them to fake it, if someone else signs it for them, it's a Federal Crime! You could send out letters with a one-time code on each of them, and then have people use that to Verify the registration. I'd love to talk more about your project, I may be able to help you out, since I just went through the work of building it, using the Credit Companies ;) Email me. cdavis@darkenedsky.com

user24 16y ago
You're right about the lack of name checking. I think it's due to people being unable to accurately spell foreign names when taking orders over the phone. Tricky problem. In fact if you solve it nicely, there's probably a good argument to shift your startup's focus to doing that.