3 ms·

How do you feel about a free-forever plan behind a credit card screen? Google Cloud is this way: stay below their free usage limits for some services and you'l

by derefr 6y ago

How do you feel about a free-forever plan behind a credit card screen? Google Cloud is this way: stay below their free usage limits for some services and you'll never need to pay; but you need to give them your card up-front because it's a post-paid service and they need to ensure they can charge you if-and-when you do go over those limits. Or, for another approach: how about a plan that's free, but where there's a small one-time fee on signup, regardless of the plan you choose? (You can be upfront to your users and tell them it's a KYC measure, if you like.) Or, how about a free service, but gated with a real KYC/AML process on signup (of the "sign in through your bank" or "upload your driver's license to this third party" variety.) Any of these approaches, IMHO, would filter out the 4% of spammers; and also act as a barrier to anyone who isn't serious about eventually trying the service — while not being as much of a barrier to people like the GP poster, who take five months to get around to testing a service before becoming a diehard fan of it, and don't want to be paying for those five months, but also look in apprehension at the idea of possibly having to spend time trying to get their (as-yet-unused) trial extended.

brewdad 6y ago
This might work in a B2B relationship but as an individual, there is no site on earth that is getting me to give you my bank account or driver's license info as part of a "free" or "trial" plan. Maybe. MAYBE. I'll give you a credit card number since I know I can always dispute/chargeback if you turn out to be dishonest. No way do you get anything that can't be 100% undone within a few minutes.
- derefr 6y ago
  > give you my bank account or driver's license info as part of a "free" or "trial" plan. Re: bank accounts, nobody was suggesting that, that's not how KYC systems work. Re: driver's license info, that's not quite how (well-implemented, modern) KYC flows work, either. For "signing up using your bank", I wasn't talking about giving the service a photo of a void cheque or anything; I was talking about doing Single Sign-On into the service, with your bank acting as the SSO (usually SAML) provider, through a SAML broker. I don't know if this is common anywhere else, but in Canada we have a pretty popular SAML SSO broker doing this (https://securekey.com/ https://securekey.com/) ; it allows you to use all our major banks as SSO authentication agents (works with both web and mobile-app flows); and this SSO method is in use for many government sites (e.g. it's how you log in to file your taxes, pay federal student loans, etc.) Any (Canadian) business can actually add SSO to their site/app through this broker. And, just like with any other (good) SSO method, the app being signed into through the SSO broker doesn't receive your credentials. Re: driver's license info, with regular KYC flows, you don't upload your driver's license info to the first party. Instead, you're directed to a trusted neutral third party (the KYC/AML provider), who has their own app; you give your credentials to that service, through its own app, which is essentially the account-creation flow for your account with that service; and then the first-party service you were interacting with SSOs you through the KYC service as an OAuth/OIDC flow.
  - curryst 6y ago
    I'm not familiar enough with SSO flows to be able to quantify any kind of risk, but it makes me very uneasy when things interconnect with my bank. Everything always seems secure until it isn't. I don't mean to spread FUD, it just seems needlessly risky to make banks the central point of auth.
    - virgilp 6y ago
      It really isn't/ shouldn't be. In theory, the bank is really incentivized to provide proper and secure authentication (if someone can impersonate you to your bank, you're kinda screwed anyway). So, it only makes sense to trust a bank to provide the authentication service. One should realize that SSO integration with a bank doesn't mean 3rd party has any sort of access to the bank - it' just means that you authorize your bank to tell a 3rd party "yes, I believe this is really curryst"). Doesn't increase the attack surface for you - it only increases the "blast radius" if someone successfully compromises your bank account. But that one is typically already a dire situation.
      - vetinari 6y ago
        It does increase the risk for you, the same way using Google or Facebook account does. Once the bank won't authenticate you for some reason, all the accounts bound to this SSO provider also go the way of dodo.
  - dkersten 6y ago
    > I was talking about doing Single Sign-On into the service, with your bank acting as the SSO (usually SAML) provider Personally, I use my bank only for banking and would never ever consider using them as an SSO provider. They handle my money, I don't want them to handle anything else or have any more information about me than they already do. Also, in my personal experience, the banks aren't very technologically competent, so the less they are expected to do, the better.
mjevans 6y ago
What's your use case for the "one time fee"? Is this a barrier to prevent bad actors? I can easily see use cases where someone without buying power can get a 50, maybe even 100 USD bond or 'license' of some sort PROVIDED that there's either only one or even more ideally a set of competitors who's "not a bad actor" licenses are interoperable; and work on the whole Internet for that task (without expiring until bad karma is dinged). However no, nickle and dime-d to death, as well as those 'free but remember to cancel' plans, are the exact reason I'd never hand over real billing info until I'm serious about being billed.
- derefr 6y ago
  The one-time fee is an e-stamp, basically. It makes having N identities N times as expensive as having one. It's one of the oldest anti-spam suggestions, from before spam filters were invented. What you're talking about with that "license" is exactly what you get by everybody relying on a small set of KYC providers; except that the KYC provider doesn't charge you for registration, but instead requires a Proof-of-Stake in some state's legal system (i.e. a set of documents that require laborious up-front proofs to acquire, such that it's very hard to acquire two sets of them, but which can be used to validate identity freely once issued.) KYC providers that just charge $100 instead of requiring a Proof-of-Stake challenge exist, too. That's essentially the (secondary?) purpose of businesses that will only trade with other incorporated businesses (or, to abstract that away, only with businesses that have a Dun & Bradstreet DUNS number): it costs $100 to incorporate, or to register one of those numbers, so you have to be at least $100 of serious to bother them, and you can't just keep spending hundred-dollar-bills forever to keep generating new identities to DDoS someone. What I haven't heard of, interestingly, is a KYC provider that requires a proof of work. Something like "solve a thousand Captchas to create an account." Or a formalized version of the old "take a photo of yourself holding up today's newspaper." But that'd be totally workable as well.
- pitay 6y ago
  I treat 'free but remember to cancel' plans as scams. About 10 months ago I got emails from a company that developed an development environment that was I was mildly interested in. They presented an offer with said it was free so that people could help educate themselves during lockdown. Unfortunately the terms was after 1 year you needed to pay something like $1500 if you didn't cancel, these terms were right at the bottom of the page and very hard to spot. Paid through PayPal and the about $1500 was there right in front of me. I cancelled it on the same day. A company offering that sort of deal waiting for people not to cancel and saying it is to help people during the lockdowns is just awful.

by derefr 6y ago

brewdad 6y ago

This might work in a B2B relationship but as an individual, there is no site on earth that is getting me to give you my bank account or driver's license info as part of a "free" or "trial" plan. Maybe. MAYBE. I'll give you a credit card number since I know I can always dispute/chargeback if you turn out to be dishonest. No way do you get anything that can't be 100% undone within a few minutes.

derefr 6y ago
> give you my bank account or driver's license info as part of a "free" or "trial" plan. Re: bank accounts, nobody was suggesting that, that's not how KYC systems work. Re: driver's license info, that's not quite how (well-implemented, modern) KYC flows work, either. For "signing up using your bank", I wasn't talking about giving the service a photo of a void cheque or anything; I was talking about doing Single Sign-On into the service, with your bank acting as the SSO (usually SAML) provider, through a SAML broker. I don't know if this is common anywhere else, but in Canada we have a pretty popular SAML SSO broker doing this (https://securekey.com/ https://securekey.com/) ; it allows you to use all our major banks as SSO authentication agents (works with both web and mobile-app flows); and this SSO method is in use for many government sites (e.g. it's how you log in to file your taxes, pay federal student loans, etc.) Any (Canadian) business can actually add SSO to their site/app through this broker. And, just like with any other (good) SSO method, the app being signed into through the SSO broker doesn't receive your credentials. Re: driver's license info, with regular KYC flows, you don't upload your driver's license info to the first party. Instead, you're directed to a trusted neutral third party (the KYC/AML provider), who has their own app; you give your credentials to that service, through its own app, which is essentially the account-creation flow for your account with that service; and then the first-party service you were interacting with SSOs you through the KYC service as an OAuth/OIDC flow.
- curryst 6y ago
  I'm not familiar enough with SSO flows to be able to quantify any kind of risk, but it makes me very uneasy when things interconnect with my bank. Everything always seems secure until it isn't. I don't mean to spread FUD, it just seems needlessly risky to make banks the central point of auth.
  - virgilp 6y ago
    It really isn't/ shouldn't be. In theory, the bank is really incentivized to provide proper and secure authentication (if someone can impersonate you to your bank, you're kinda screwed anyway). So, it only makes sense to trust a bank to provide the authentication service. One should realize that SSO integration with a bank doesn't mean 3rd party has any sort of access to the bank - it' just means that you authorize your bank to tell a 3rd party "yes, I believe this is really curryst"). Doesn't increase the attack surface for you - it only increases the "blast radius" if someone successfully compromises your bank account. But that one is typically already a dire situation.
    - vetinari 6y ago
      It does increase the risk for you, the same way using Google or Facebook account does. Once the bank won't authenticate you for some reason, all the accounts bound to this SSO provider also go the way of dodo.
- dkersten 6y ago
  > I was talking about doing Single Sign-On into the service, with your bank acting as the SSO (usually SAML) provider Personally, I use my bank only for banking and would never ever consider using them as an SSO provider. They handle my money, I don't want them to handle anything else or have any more information about me than they already do. Also, in my personal experience, the banks aren't very technologically competent, so the less they are expected to do, the better.

mjevans 6y ago

What's your use case for the "one time fee"? Is this a barrier to prevent bad actors? I can easily see use cases where someone without buying power can get a 50, maybe even 100 USD bond or 'license' of some sort PROVIDED that there's either only one or even more ideally a set of competitors who's "not a bad actor" licenses are interoperable; and work on the whole Internet for that task (without expiring until bad karma is dinged). However no, nickle and dime-d to death, as well as those 'free but remember to cancel' plans, are the exact reason I'd never hand over real billing info until I'm serious about being billed.

derefr 6y ago
The one-time fee is an e-stamp, basically. It makes having N identities N times as expensive as having one. It's one of the oldest anti-spam suggestions, from before spam filters were invented. What you're talking about with that "license" is exactly what you get by everybody relying on a small set of KYC providers; except that the KYC provider doesn't charge you for registration, but instead requires a Proof-of-Stake in some state's legal system (i.e. a set of documents that require laborious up-front proofs to acquire, such that it's very hard to acquire two sets of them, but which can be used to validate identity freely once issued.) KYC providers that just charge $100 instead of requiring a Proof-of-Stake challenge exist, too. That's essentially the (secondary?) purpose of businesses that will only trade with other incorporated businesses (or, to abstract that away, only with businesses that have a Dun & Bradstreet DUNS number): it costs $100 to incorporate, or to register one of those numbers, so you have to be at least $100 of serious to bother them, and you can't just keep spending hundred-dollar-bills forever to keep generating new identities to DDoS someone. What I haven't heard of, interestingly, is a KYC provider that requires a proof of work. Something like "solve a thousand Captchas to create an account." Or a formalized version of the old "take a photo of yourself holding up today's newspaper." But that'd be totally workable as well.
pitay 6y ago
I treat 'free but remember to cancel' plans as scams. About 10 months ago I got emails from a company that developed an development environment that was I was mildly interested in. They presented an offer with said it was free so that people could help educate themselves during lockdown. Unfortunately the terms was after 1 year you needed to pay something like $1500 if you didn't cancel, these terms were right at the bottom of the page and very hard to spot. Paid through PayPal and the about $1500 was there right in front of me. I cancelled it on the same day. A company offering that sort of deal waiting for people not to cancel and saying it is to help people during the lockdowns is just awful.