6 ms·

Hey, Aaron the builder here. The scamming that happens to homebuyers is not even comparable to the risk in uploading docs to a website which promises they won'

by aaln 2y ago

Hey, Aaron the builder here. The scamming that happens to homebuyers is not even comparable to the risk in uploading docs to a website which promises they won't share user data with anyone. This is genuinely a pro buyer tool with no association with any 3rd party. The tool has already helped many people negotiate and get a better deal on their mortgage. Please before judging understand that 70% of buyers overpay in their mortgage 1-3% in closing costs and bad rates. It's mind boggling how much lenders get away with profiting in junk fees from stressed out homebuyers.

gruez 2y ago
>The scamming that happens to homebuyers is not even comparable to the risk in uploading docs to a website which promises they won't share user data with anyone. Well as long as you promise, my privacy fears are allayed! /s
mannyv 2y ago
Ignore the haters, they will probably never be your customer.
- deleted 2y ago
  [deleted]
- effingwewt 2y ago
  Ah the Disney approach. Bold strategy Cotton. Owner did the smart thing and listened to the constructive criticism which made me feel infinitely better about using his tool. Which I will now do, and would not have before. I am also his exact customer.
  - KPGv2 2y ago
    > Ah the Disney approach. Bold strategy Cotton. The Disney approach, if successful, would make you very rich. Their approach has made them one of the most powerful companies in the world.
- ziddoap 2y ago
  People are trying to increase the potential customer base of the author by pointing out where there is room to improve. That is incredibly valuable, and one of the major reasons to do a Show HN. That is not being a "hater".
  - cj 2y ago
    The percentage of regular people who care about any of the risks discussed in this thread is approximately zero. For better or worse. Your typical home buyer isn't reading the contract they sign when they buy a home, let alone the privacy policy of a simple tool they use to check if they have a mortgage with decent terms.
    - ziddoap 2y ago
      When people who do care about privacy and security make their voices heard, such as the case here where the owner has committed to improving their policy & processes, it benefits everyone using the product or service.
      - cj 2y ago
        It’s not in the spirit of a “Show HN” to attack the guy’s privacy policy and shut down the idea over security concerns that the general public wouldn’t think twice about.
        ziddoap 2y ago
        No one "attacked" the author. The first comment said "not inspiring confidence" and then WaitWaitWha gave a very thoughtful comment with actionable advice, based on that comment and the reply. These are not attacks.
  - fragmede 2y ago
    https://news.ycombinator.com/item?id=42150219 https://news.ycombinator.com/item?id=42150219 was highly constructive. It was direct and actionable. kojeovo's original comment was less so. When you build a product, you're going to get random, in-actionable comments from people who just like to complain. Separating the signal from noise is difficult, and while there is a underlying concern about privacy, not giving anything actionable moves it towards to the noise side of the spectrum.
bredren 2y ago
It is fair to describe the pains of not getting analysis on mortgage loan estimates, but what I think folks are looking for is some kind of authentic answer to the problem posed. For example, you could advise the person uploading to remove PII prior to the upload, and link to pdf editing tools that allow them to do that. You could say that not including PII like full name(s) found on just about every loan estimate does not take away from the value of the tool. Another thing that could be done is to provide clear means for removing any data uploaded, or opt-out pre-upload of any data being used for training. For example by creating an account first. Providing some skin in the game such as putting the removal behavior in the terms of service and a personal guarantee to do everything to ensure sensitivity to privacy of this information will be handled carefully staking your reputation, probably would help.
- aaln 2y ago
  Thank you for these suggestions, I'm going to advise users to remove PII before uploading and eventually allow users to purge their data.
WaitWaitWha 2y ago
Allow me to expound on @kojeovo's remark. Please take this as a constructive criticism to improve your success potential. Much of it is from a quick glance, and am sure there are many other facets to improve. A business is not just about the product. Your Privacy Policy. There is no default way to download it (see 9.), and since it is window-ed cannot print entire doc. That means I cannot keep a copy of it for myself. > We collect the following types of information: > Mortgage Documents: Loan Estimates and Closing Disclosures you upload for analysis. Okay, but > 4. Data Security > We implement industry-standard security measures to protect your information from unauthorized access, disclosure, alteration, and destruction. This means nothing. Are you ISO 27001:2022, NIST SP 800-53, CIS, CE+, Essential Eight, or something else? Have you been audited, and proof? Who is your ISP? What regs do you follow around data sovereignty? Terms of Service. Again, no default way of download. Overall, I would never agree to this ToS. It demands all kinds of requirements on the user, but takes no responsibility for anything - or as described above, explain how you will protect your customers. You have no reference anywhere where you are geographically. No address, no about us, no who you are. I would be very leery on uploading anything.
- mmh0000 2y ago
  Would it matter if they had a "perfect" privacy policy? I don't believe there's anything legally that enforces it. So they can promise the moon then turn around and sell your data. Maybe I'm wrong here, but, My mental model of privacy policies and the like has always been: This is a lie, the company will do whatever it wants with my data. And I will have no recourse. As such I've always acted accordingly. And very few websites have legit info on me.
  - T4iga 2y ago
    I think acting 'as if' is the safe option here but encouraging change for the better in someone willing to engage in dialog is still better than not doing it. Maybe you didn't intend to make a counterpoint, i just wanted to point that out.
- adamtaylor_13 2y ago
  Legitimately curious, what’s the worst they could do with this data?
swatcoder 2y ago
FYI, this reads as a very aggressive response to someone raising legitimate privacy concerns and doesn't engender the trust you very likely deserve. Rather than talking up the value of the tool as superceding the concerns, a more constructive approach might acknowledge the concerns and emphasize how you already do minimize risk or commitments you're willing to make towards doing so. Being dismissive doesn't help worried or skeptical people feel more secure, and worried and skeptical people make perfectly good users too.
- monktastic1 2y ago
  Interesting. I didn't read it as aggressive, and certainly not "very" aggressive. I read it as polite and perhaps mildly defensive. What about the response suggests aggression to you?
jjav 2y ago
> not even comparable to the risk in uploading docs to a website which promises they won't share user data with anyone. This is genuinely a pro buyer tool with no association with any 3rd party. I have no reason to think you're not completely sincere in this! But, realize it doesn't mean anything. Unless that promise is backed by some ironclad contract, it means nothing. Companies grow and hire new people who don't care about the original values. Or they get acquired and all bets are off. Or they start running low on cash and suddenly decide monetizing all that data is a good idea after all. Or it becomes visible enough to attract attention of the government who shows up demanding copies of data. And so on. I've been in one or more startups where all of these things have happened.
deleted 2y ago
[deleted]
dylan604 2y ago
Also, you have no control over decisions that any future owner might have, and you won't care because you've already cashed out. What happens when you get hacked? Not if. To come back at someone with valid concerns with a "no, you don't understand my point of view" does nothing but a disservice to you. Expecting people to just accept things is just not a good way to operate. When you receive push back, you need better responses than this. Will the vast majority of your users push back, sadly, probably not. However, you did post this to HN and then reacted poorly to valid criticism. Tsk tsk
datavirtue 2y ago
I love this idea (haven't tried it) and it seems like a killer app for AI. I can think of a lot of other things like health insurance, home owners insurance, and many other types of contracts for which an AI advisor can be built for. Imagine being able to rake over a complex document and make decisions that clearly benefit you. That's a rare privilege.
egorfine 2y ago
I am genuinely surprised by the comments in this thread. Privacy concerns are real but the importance of that matter in your project is overestimated here by an absurd level. What I read is not a constructive criticism and the suggestions laid down are not realistic nor business relevant at all. I feel like this is some sort of mass wishful thinking.
- sangnoir 2y ago
  Title deposit wire fraud is a very big risk. The amounts are devastating to the victims, so the operator has to go above and beyond to secure the data because of the huge risks involved. Would you risk losing a 5-/6-digit amount to fraud in order to potentially save on a 4-digit closing fee?
- ryandrake 2y ago
  I think it's actually refreshing to see the top comments and constructive criticism be about privacy concerns. It shows that even for little "Show HN" projects, there is growing intolerance of half-assing it. Not saying OP in particular is half-assing it, but it's good to see these questions being regularly asked front and center. I honestly wish the Tech Media paid more attention to privacy and security instead of just copy-pasting companies' PR statements as "articles."
  - paulcole 2y ago
    My opinion is that the OP shouldn’t even half-ass it. Ignore anybody who has complaints about privacy and 0-ass it. People just love complaining and telling other people The Right Way To Do Things.
    - kojeovo 2y ago
      As the OP, I wasn't even complaining about privacy of the app or site per se. It was just feedback on how that part of the landing page copy made me, a potential consumer of the product (I'm in the process of buying a house rn) made me feel in the moment. Could be a quick copy change to fix.
bastloing 2y ago
Doesn't matter your promise, even though you may or may not be trusted, hackers can get it and steal it all. So it's not necessarily you or your service.
chourobin 2y ago
Great idea and execution. I understand the privacy concerns, but I believe implementing a client-side redaction step could alleviate some of them. This step would allow users to preview their uploaded content before submitting it. While designing this feature, it’s crucial to ensure user trust and convince them of its benefits. Personally, I would feel more comfortable uploading a PDF knowing that it will be anonymized or redacted before being submitted.
mgaunard 2y ago
How can you get scammed on a mortgage? They're typically standard products from nationwide banks.
stevebmark 2y ago
Your response is a lighthouse sized red flashing light to never use your tool.
kojeovo 2y ago
Hey. I really don't care to compare the level of scamming nor the usefulness of the tool. I'm in the process of buying right now so I know it could be useful. That's besides the point. To clarify, here's a different thought. Reading the following copy, I am wondering "whats gonna happen to my data / file I upload?": > We never sell or share data with third parties. All information is used solely to generate analyses to help borrowers analyze and optimize their mortgages. I even looked further into the privacy policy, just to be diligent here. > We implement industry-standard security measures to protect your information from unauthorized access, disclosure, alteration, and destruction. With how much info I have been provided, I'm just not gonna upload a document to your site. Like I said, just doesn't inspire confidence as I scroll your landing page. Could just be a copy change to fix this.

by aaln 2y ago

gruez 2y ago

>The scamming that happens to homebuyers is not even comparable to the risk in uploading docs to a website which promises they won't share user data with anyone. Well as long as you promise, my privacy fears are allayed! /s

mannyv 2y ago

Ignore the haters, they will probably never be your customer.

deleted 2y ago
[deleted]
effingwewt 2y ago
Ah the Disney approach. Bold strategy Cotton. Owner did the smart thing and listened to the constructive criticism which made me feel infinitely better about using his tool. Which I will now do, and would not have before. I am also his exact customer.
- KPGv2 2y ago
  > Ah the Disney approach. Bold strategy Cotton. The Disney approach, if successful, would make you very rich. Their approach has made them one of the most powerful companies in the world.
ziddoap 2y ago
People are trying to increase the potential customer base of the author by pointing out where there is room to improve. That is incredibly valuable, and one of the major reasons to do a Show HN. That is not being a "hater".
- cj 2y ago
  The percentage of regular people who care about any of the risks discussed in this thread is approximately zero. For better or worse. Your typical home buyer isn't reading the contract they sign when they buy a home, let alone the privacy policy of a simple tool they use to check if they have a mortgage with decent terms.
  - ziddoap 2y ago
    When people who do care about privacy and security make their voices heard, such as the case here where the owner has committed to improving their policy & processes, it benefits everyone using the product or service.
    - cj 2y ago
      It’s not in the spirit of a “Show HN” to attack the guy’s privacy policy and shut down the idea over security concerns that the general public wouldn’t think twice about.
      - ziddoap 2y ago
        No one "attacked" the author. The first comment said "not inspiring confidence" and then WaitWaitWha gave a very thoughtful comment with actionable advice, based on that comment and the reply. These are not attacks.
- fragmede 2y ago
  https://news.ycombinator.com/item?id=42150219 https://news.ycombinator.com/item?id=42150219 was highly constructive. It was direct and actionable. kojeovo's original comment was less so. When you build a product, you're going to get random, in-actionable comments from people who just like to complain. Separating the signal from noise is difficult, and while there is a underlying concern about privacy, not giving anything actionable moves it towards to the noise side of the spectrum.

bredren 2y ago

It is fair to describe the pains of not getting analysis on mortgage loan estimates, but what I think folks are looking for is some kind of authentic answer to the problem posed. For example, you could advise the person uploading to remove PII prior to the upload, and link to pdf editing tools that allow them to do that. You could say that not including PII like full name(s) found on just about every loan estimate does not take away from the value of the tool. Another thing that could be done is to provide clear means for removing any data uploaded, or opt-out pre-upload of any data being used for training. For example by creating an account first. Providing some skin in the game such as putting the removal behavior in the terms of service and a personal guarantee to do everything to ensure sensitivity to privacy of this information will be handled carefully staking your reputation, probably would help.

aaln 2y ago
Thank you for these suggestions, I'm going to advise users to remove PII before uploading and eventually allow users to purge their data.

WaitWaitWha 2y ago

Allow me to expound on @kojeovo's remark. Please take this as a constructive criticism to improve your success potential. Much of it is from a quick glance, and am sure there are many other facets to improve. A business is not just about the product. Your Privacy Policy. There is no default way to download it (see 9.), and since it is window-ed cannot print entire doc. That means I cannot keep a copy of it for myself. > We collect the following types of information: > Mortgage Documents: Loan Estimates and Closing Disclosures you upload for analysis. Okay, but > 4. Data Security > We implement industry-standard security measures to protect your information from unauthorized access, disclosure, alteration, and destruction. This means nothing. Are you ISO 27001:2022, NIST SP 800-53, CIS, CE+, Essential Eight, or something else? Have you been audited, and proof? Who is your ISP? What regs do you follow around data sovereignty? Terms of Service. Again, no default way of download. Overall, I would never agree to this ToS. It demands all kinds of requirements on the user, but takes no responsibility for anything - or as described above, explain how you will protect your customers. You have no reference anywhere where you are geographically. No address, no about us, no who you are. I would be very leery on uploading anything.

mmh0000 2y ago
Would it matter if they had a "perfect" privacy policy? I don't believe there's anything legally that enforces it. So they can promise the moon then turn around and sell your data. Maybe I'm wrong here, but, My mental model of privacy policies and the like has always been: This is a lie, the company will do whatever it wants with my data. And I will have no recourse. As such I've always acted accordingly. And very few websites have legit info on me.
- T4iga 2y ago
  I think acting 'as if' is the safe option here but encouraging change for the better in someone willing to engage in dialog is still better than not doing it. Maybe you didn't intend to make a counterpoint, i just wanted to point that out.
adamtaylor_13 2y ago
Legitimately curious, what’s the worst they could do with this data?

swatcoder 2y ago

FYI, this reads as a very aggressive response to someone raising legitimate privacy concerns and doesn't engender the trust you very likely deserve. Rather than talking up the value of the tool as superceding the concerns, a more constructive approach might acknowledge the concerns and emphasize how you already do minimize risk or commitments you're willing to make towards doing so. Being dismissive doesn't help worried or skeptical people feel more secure, and worried and skeptical people make perfectly good users too.

monktastic1 2y ago
Interesting. I didn't read it as aggressive, and certainly not "very" aggressive. I read it as polite and perhaps mildly defensive. What about the response suggests aggression to you?

jjav 2y ago

> not even comparable to the risk in uploading docs to a website which promises they won't share user data with anyone. This is genuinely a pro buyer tool with no association with any 3rd party. I have no reason to think you're not completely sincere in this! But, realize it doesn't mean anything. Unless that promise is backed by some ironclad contract, it means nothing. Companies grow and hire new people who don't care about the original values. Or they get acquired and all bets are off. Or they start running low on cash and suddenly decide monetizing all that data is a good idea after all. Or it becomes visible enough to attract attention of the government who shows up demanding copies of data. And so on. I've been in one or more startups where all of these things have happened.

deleted 2y ago

[deleted]

dylan604 2y ago

Also, you have no control over decisions that any future owner might have, and you won't care because you've already cashed out. What happens when you get hacked? Not if. To come back at someone with valid concerns with a "no, you don't understand my point of view" does nothing but a disservice to you. Expecting people to just accept things is just not a good way to operate. When you receive push back, you need better responses than this. Will the vast majority of your users push back, sadly, probably not. However, you did post this to HN and then reacted poorly to valid criticism. Tsk tsk

datavirtue 2y ago

I love this idea (haven't tried it) and it seems like a killer app for AI. I can think of a lot of other things like health insurance, home owners insurance, and many other types of contracts for which an AI advisor can be built for. Imagine being able to rake over a complex document and make decisions that clearly benefit you. That's a rare privilege.

egorfine 2y ago

I am genuinely surprised by the comments in this thread. Privacy concerns are real but the importance of that matter in your project is overestimated here by an absurd level. What I read is not a constructive criticism and the suggestions laid down are not realistic nor business relevant at all. I feel like this is some sort of mass wishful thinking.

sangnoir 2y ago
Title deposit wire fraud is a very big risk. The amounts are devastating to the victims, so the operator has to go above and beyond to secure the data because of the huge risks involved. Would you risk losing a 5-/6-digit amount to fraud in order to potentially save on a 4-digit closing fee?
ryandrake 2y ago
I think it's actually refreshing to see the top comments and constructive criticism be about privacy concerns. It shows that even for little "Show HN" projects, there is growing intolerance of half-assing it. Not saying OP in particular is half-assing it, but it's good to see these questions being regularly asked front and center. I honestly wish the Tech Media paid more attention to privacy and security instead of just copy-pasting companies' PR statements as "articles."
- paulcole 2y ago
  My opinion is that the OP shouldn’t even half-ass it. Ignore anybody who has complaints about privacy and 0-ass it. People just love complaining and telling other people The Right Way To Do Things.
  - kojeovo 2y ago
    As the OP, I wasn't even complaining about privacy of the app or site per se. It was just feedback on how that part of the landing page copy made me, a potential consumer of the product (I'm in the process of buying a house rn) made me feel in the moment. Could be a quick copy change to fix.

bastloing 2y ago

Doesn't matter your promise, even though you may or may not be trusted, hackers can get it and steal it all. So it's not necessarily you or your service.

chourobin 2y ago

Great idea and execution. I understand the privacy concerns, but I believe implementing a client-side redaction step could alleviate some of them. This step would allow users to preview their uploaded content before submitting it. While designing this feature, it’s crucial to ensure user trust and convince them of its benefits. Personally, I would feel more comfortable uploading a PDF knowing that it will be anonymized or redacted before being submitted.

mgaunard 2y ago

How can you get scammed on a mortgage? They're typically standard products from nationwide banks.

stevebmark 2y ago

Your response is a lighthouse sized red flashing light to never use your tool.

kojeovo 2y ago

Hey. I really don't care to compare the level of scamming nor the usefulness of the tool. I'm in the process of buying right now so I know it could be useful. That's besides the point. To clarify, here's a different thought. Reading the following copy, I am wondering "whats gonna happen to my data / file I upload?": > We never sell or share data with third parties. All information is used solely to generate analyses to help borrowers analyze and optimize their mortgages. I even looked further into the privacy policy, just to be diligent here. > We implement industry-standard security measures to protect your information from unauthorized access, disclosure, alteration, and destruction. With how much info I have been provided, I'm just not gonna upload a document to your site. Like I said, just doesn't inspire confidence as I scroll your landing page. Could just be a copy change to fix this.