6 ms·

Never figured out how to use Hertzner. Wanted to try since they get such a good reputation on here, but they banned my account when their system presented no wa

by Galaco 3y ago

Never figured out how to use Hertzner. Wanted to try since they get such a good reputation on here, but they banned my account when their system presented no way for me to verify my identity. The required either PayPal or passport. I have no PayPal account, and their 3rd party verification system only allows passport from your country of residence (signup requires providing a contact address and they pre fill using this address; you can’t change the passport country). I am a British citizen living in Japan, and therefore hold a British passport; there was no way for me to provide a Japanese passport. I asked what I should do to comply, and they banned my account 6 hours later. I can’t be the only one to experience this, can I?

lordnacho 3y ago
They seem pretty good at writing back to people. Have you contacted them? It's normal for new accounts to get suspended pending KYC checks. But they also do the checks pretty fast.
- danesparza 3y ago
  The OP indicated this in their original comment: "I asked what I should do to comply, and they banned my account 6 hours later."
  - withinboredom 3y ago
    That’s pretty suss. Just send your passport and if they have any issues with it, they’ll ask. If they ask you for your passport and you ask “how do I comply” I’d probably suspend the account to since you seem unable or unwilling to comply.
    - jackothy 3y ago
      They asked him for a Japanese passport and he does not have one. Hence the "how do I comply".
      - withinboredom 3y ago
        Just send the one you have? I don’t see the problem.
        jackothy 3y ago
        And I also don't see the problem with asking a clarifying question when he does not have what they asked for.
        withinboredom 3y ago
        It’s obviously a typo or something similar. The customer support person likely has no idea what you’re talking about, they want a passport with your name on it, they don’t care where it is from.
jacooper 3y ago
Just send them a photo of your British passport
bravetraveler 3y ago
Sadly not, and I'm one of the happy Hetzner customers They are remarkably well known for having draconian anti-fraud
jonatron 3y ago
This has come up a few times on HN, if you search comments for "Hetzner fraud". The solution is to use a different provider if you can't use Hetzner.
- derefr 3y ago
  I've seen the other side of this. Our SaaS (a data API) has a number of "customers" who attempt to use us (or our competitors; we're not special here) to power some data displays on their phishing-scam websites, to make them seem more legitimate. We ban these people — they're violating our ToU by engaging in illegal activities. But they come back. With different names, different IPs, different browsers, different credit cards. They have complete identities to burn. (We spot the correlations anyway, along other dimensions I won't disclose here, and so can keep them out pretty effectively.) And guess what? Very often, their requests are coming from Hetzner IP blocks. I don't think the scammers have a direct business relationship with Hetzner, mind you. I think Hetzner tries just as hard as we do to stop these people from making use of their services. But I believe that these Hetzner boxes are either set up as exit nodes of one or more common VPN providers; or they're being registered for other purposes by other parties, and then resold on the secondary market on dark-web forums. If I were a VPS provider, and I didn't want to support illegal activity, I'd probably just give up on providing service to individuals altogether, only taking corporate customers; and even then, requiring a DUNS number or something as an additional proof-of-work for that corporation, so that people can't just keep spinning up corporations in places where that's essentially free. Hetzner hasn't gone that far; but it makes sense to me that if a user account is flagged as needing extended verification, and the ops person responsible for verifying the account takes a look at the user-lifecycle activity logs for the user, and sees that this user has: their IP coming from multiple places during registration vs login, their browser locale and timezone bouncing around between requests and set for settings uncommon to the country their IP is originating from, etc. — that the answer would be "ban" rather than "ask the user why the heck that's happening." One time out of ten, the user is a real person doing something weird. The other nine times out of ten, the user is a scammer and is going to make up some story about being a real person doing something weird. Every scammer has their very own pool of man-hours, and if you're in the critical path for their scam, they can burn a number of those man-hours being really insistent that they're authentic. Until you let them in, and see that they immediately start up the same dumb phishing-scam bot script that all the other scammers purchased.
delusional 3y ago
I sent them a photo of my passport encrypted with their pgp key. This was a long time ago, so the process might have changed, but it seemed entirely manual.
nr2x 3y ago
I’m currently setting up infrastructure for a startup and it’s been very interesting how the threat model of data loss and disaster recovery is no longer hardware failure: it’s account lock out. I’ve got streaming replication of my core data going from one cloud company to other company as that way if one has some antifraud system go rogue on me I still have access. As somebody who used to spend a lot of time thinking about drives breaking it’s an interesting shift.
- Aldipower 3y ago
  Exactly. My main infrastructure is on Hetzner, but I have a live replication via Wireguard at another hoster in Austria. With less resources there, but for accessibility "in the case of".
  - nr2x 3y ago
    I’m also thinking about buying a second hand server and racking it in a colocation joint just so I can physically get the disk. The client data I have is super important, and there is some level of comfort you only get from bare metal.
    - miohtama 3y ago
      I would go further and have a small server/NAS running locally in an office. The best backup is one you sit on the top off.
      - nr2x 3y ago
        I literally have a Linux machine that I’m ready to rig up were it not for Comcast being my internet provider. Maddening to live in “Silicon Valley” and be dealing with dog shit data caps and speeds.
      - Aldipower 3y ago
        This does not pay out in Germany due to the high energy costs in private house holds or office spaces.
thatwasunusual 3y ago
> Never figured out how to use Hertzner. Wanted to try since they get such a good reputation on here, but they banned my account when their system presented no way for me to verify my identity. Is this something new? I (Norwegian) have been using Hetzner for 10+ years, and never had a problem, and never had to attest my identity. CurrentlyI have a four servers running there. The last one was set up approx. a year ago, IIRC.
- Havoc 3y ago
  >I (Norwegian) That may be the difference. Some nationalities get KYC'd easier than others and they seem to take it very seriously
  - kldx 3y ago
    +1 anecdatum
  - rejectfinite 3y ago
    There is a reason :)
- jsnell 3y ago
  It's definitely not new, they required an id 20 years ago. (From EU citizens, so it's not about the country either).
  - dividedbyzero 3y ago
    For what it's worth, I have a VM on their cloud offering and I've never had to provide them with an ID.
  - thatwasunusual 3y ago
    So how do you explain that I never have had to show an ID?
    - detaro 3y ago
deleted 3y ago
[deleted]
EVa5I7bHFq9mnYK 3y ago
I think they really care about two things: VAT and cryptocurrency. Passports are required to prove you should or should not pay the 19% VAT, and crypto (namely, SIA) destroy their servers.
- yrro 3y ago
  Whoa whoa whoa I can opt out of paying VAT? How do I do this!
  - EVa5I7bHFq9mnYK 3y ago
    That's exactly why they have draconian KYC measures in place)
  - mjochim 3y ago
    Have a company whose business purpose justifies spending company money on servers. Make a profit so you have company money to spend. Spend it on servers. There you go.
  - marcosdumay 3y ago
    You prove you don't reside on the EU, and they don't bill you the VAT. (But I believe the KYC rules aren't only because of this.)
    - yrro 3y ago
      You got my hopes up but it seems I'm stuck paying UK VAT even though I don't think it's necessary any more. I've run into this with a few different German businesses, I don't know if I'm right or they are, but it seems like they don't _have_ to charge me VAT. Which is underlined by the huge "import VAT" bill I'm dumped with when I have physical goods delivered to me in the UK.
      - robjan 3y ago
        They do have to charge you VAT unless you are a VAT registered limited company
nixass 3y ago
> The required either PayPal or passport I had similar struggles with some non-IT service providers in Germany. They couldn't fathom why I have non-German nationality, German address and driving license from third country. Passport, German address and driving license all have different address on them (all three being EU addresses). It is apparently huge red flag in EU in 21st century. Incredible
- 2000UltraDeluxe 3y ago
  You have an address on your passport? I can see how that could cause issues if the address isn't valid. If I'd have to determine if your order was fraudulent or not, I'd err on the side of caution rather than risk having you abuse my server infrastructure (in the case of Hetzner).
  - datenwolf 3y ago
    A lot of people confuse the passport (Pass) with the national identity card (Personalausweis). There's no place of residence stated on the German passport, but it is part of the Personalausweis. Since German citizens by law are required to own a Personalausweis (there's no mandate to carry it around, just having it somewhere in a drawer suffices), practically all businesses in Germany do rely on the Personalausweis to validate identities. And of course if the place of residence stated on the Personalausweis doesn't match the actual place of residence this is going to trigger some red flags.
    - andix 3y ago
      This is a very German thing. I’ve never seen ID cards from other countries that include an address of residence. Also the obligation to own an ID card is a very foreign concept in most other countries. I had that issue with German companies before, especially those who rarely deal with international customers. For example in Austria only a few people own an ID card (most people have a passport, but not everyone). So the german companies were very surprised when I gave them a copy of the Austrian ID card, that also doesn’t have an address on it.
sunshadow 3y ago
[dead]
unixhero 3y ago
Use a VPN connection to the UK when you verify... BOOM solved
- 2000UltraDeluxe 3y ago
  Using a VPN is one of the easiest way to get rejected. Most automated systems flag stuff coming from them as highly suspicious due to the sheer amount of crap coming through them.
  - unixhero 3y ago
    You can run your own from a vps and an ssh socks proxy.
andix 3y ago
They probably suffer from a lot of sign ups with fake IDs and with criminal intent. So I get that they are rather strict. Another thing to consider: cloud providers are not very interested in individuals as customers. They usually want companies as customers, that also buy more than a 3$ vserver. A solution for this problem could be a sign-up fee (50 or 100$), to pay for an extended manual vetting of customers, that is then added to the account balance.
- pid-1 3y ago
  > Another thing to consider: cloud providers are not very interested in individuals as customers A key theme in the "cloud vs data center" story is that most public cloud providers (AWS, etc...) were really easy to sign up, requiring a CC and nothing else. Meanwhile, hardware vendors wouldn't even talk to you as an individual / small business.
  - HansHamster 3y ago
    Tried to sign up for gcloud a couple of months ago using my >12 year old google account. Long story short, while I technically managed to sign up, I never managed to get my GPU quotas increased to anything above 0, support is non-existent and contacting sales (which seems to be the 'official' way, but is only really intended for business customers?) never got a response... Meanwhile, my small server (not Hetzner) has been running for many years without any issues, never had to send them anything after I signed up...
JacobiX 3y ago
Their compliance process is quite abysmal. This is actually exactly what happened with us. After creating a new account with the intention of exploring the ARM64 services, our account was unexpectedly suspended. I contacted them to have information on the specific concerns regarding my customer information and the reason for deactivating my account. Unfortunately, we did not receive any response to our inquiries.
qwertox 3y ago
> I have no PayPal account, and their 3rd party verification system only allows passport from your country of residence (signup requires providing a contact address and they pre fill using this address; you can’t change the passport country) Sounds like a good thing to do? My current hoster in Germany made a surprise call and asked me what the name of the hotel near the address I provided was. This after I submitted the order and before they accepted.
aent 3y ago
I provided them with my passport and all the other documents they requested and they still banned me with no recourse, so yeah, their signup process is the worst I have ever experienced.
kornhole 3y ago
You get a good range of options at a low cost with Hetzner but need to identify yourself. Many hosting companies have different levels and types of verification these days. If you want to avoid any KYC, checkout https://kycnot.me/services#VPS https://kycnot.me/services#VPS.
miduil 3y ago
> Never figured out how to use Hertzner. Wanted to try since they get such a good reputation on here, but they banned my account when their system presented no way for me to verify my identity. I ran into the same thing as well, maybe my real name sounds a bit funny to their system? It was very discouraging to move forward after being instantly banned. I reached out to them how I could verify and the only way was sending them an unencrypted mail with my Passport copy. Upon request they suggested I could simply send them a fax. Note, this has been some years ago and I've never gave Hetzner a new try. As long as I can see from professional experience, you will have a lot of back and forth with Hetzner support, which becomes quite bad the moment your team is international because they'll always manage to sneak in some sort of German text. It really feels antiquated having to go through support for basic server hardware debugging. Eventually they'll often resort to replacing your instance.
MrMan 3y ago
[dead]
lmarcos 3y ago
That's why I don't use Hetzner. I don't really want to handover my passport to any company. How come digital ocean doesn't require that?
kyriakos 3y ago
I use credit card and was never asked for a passport. That's odd. Been using them for more than 5 years.

by Galaco 3y ago

lordnacho 3y ago

They seem pretty good at writing back to people. Have you contacted them? It's normal for new accounts to get suspended pending KYC checks. But they also do the checks pretty fast.

danesparza 3y ago
The OP indicated this in their original comment: "I asked what I should do to comply, and they banned my account 6 hours later."
- withinboredom 3y ago
  That’s pretty suss. Just send your passport and if they have any issues with it, they’ll ask. If they ask you for your passport and you ask “how do I comply” I’d probably suspend the account to since you seem unable or unwilling to comply.
  - jackothy 3y ago
    They asked him for a Japanese passport and he does not have one. Hence the "how do I comply".
    - withinboredom 3y ago
      Just send the one you have? I don’t see the problem.
      - jackothy 3y ago
        And I also don't see the problem with asking a clarifying question when he does not have what they asked for.
        withinboredom 3y ago
        It’s obviously a typo or something similar. The customer support person likely has no idea what you’re talking about, they want a passport with your name on it, they don’t care where it is from.

jacooper 3y ago

Just send them a photo of your British passport

bravetraveler 3y ago

Sadly not, and I'm one of the happy Hetzner customers They are remarkably well known for having draconian anti-fraud

jonatron 3y ago

This has come up a few times on HN, if you search comments for "Hetzner fraud". The solution is to use a different provider if you can't use Hetzner.

derefr 3y ago
I've seen the other side of this. Our SaaS (a data API) has a number of "customers" who attempt to use us (or our competitors; we're not special here) to power some data displays on their phishing-scam websites, to make them seem more legitimate. We ban these people — they're violating our ToU by engaging in illegal activities. But they come back. With different names, different IPs, different browsers, different credit cards. They have complete identities to burn. (We spot the correlations anyway, along other dimensions I won't disclose here, and so can keep them out pretty effectively.) And guess what? Very often, their requests are coming from Hetzner IP blocks. I don't think the scammers have a direct business relationship with Hetzner, mind you. I think Hetzner tries just as hard as we do to stop these people from making use of their services. But I believe that these Hetzner boxes are either set up as exit nodes of one or more common VPN providers; or they're being registered for other purposes by other parties, and then resold on the secondary market on dark-web forums. If I were a VPS provider, and I didn't want to support illegal activity, I'd probably just give up on providing service to individuals altogether, only taking corporate customers; and even then, requiring a DUNS number or something as an additional proof-of-work for that corporation, so that people can't just keep spinning up corporations in places where that's essentially free. Hetzner hasn't gone that far; but it makes sense to me that if a user account is flagged as needing extended verification, and the ops person responsible for verifying the account takes a look at the user-lifecycle activity logs for the user, and sees that this user has: their IP coming from multiple places during registration vs login, their browser locale and timezone bouncing around between requests and set for settings uncommon to the country their IP is originating from, etc. — that the answer would be "ban" rather than "ask the user why the heck that's happening." One time out of ten, the user is a real person doing something weird. The other nine times out of ten, the user is a scammer and is going to make up some story about being a real person doing something weird. Every scammer has their very own pool of man-hours, and if you're in the critical path for their scam, they can burn a number of those man-hours being really insistent that they're authentic. Until you let them in, and see that they immediately start up the same dumb phishing-scam bot script that all the other scammers purchased.

delusional 3y ago

I sent them a photo of my passport encrypted with their pgp key. This was a long time ago, so the process might have changed, but it seemed entirely manual.

nr2x 3y ago

I’m currently setting up infrastructure for a startup and it’s been very interesting how the threat model of data loss and disaster recovery is no longer hardware failure: it’s account lock out. I’ve got streaming replication of my core data going from one cloud company to other company as that way if one has some antifraud system go rogue on me I still have access. As somebody who used to spend a lot of time thinking about drives breaking it’s an interesting shift.

Aldipower 3y ago
Exactly. My main infrastructure is on Hetzner, but I have a live replication via Wireguard at another hoster in Austria. With less resources there, but for accessibility "in the case of".
- nr2x 3y ago
  I’m also thinking about buying a second hand server and racking it in a colocation joint just so I can physically get the disk. The client data I have is super important, and there is some level of comfort you only get from bare metal.
  - miohtama 3y ago
    I would go further and have a small server/NAS running locally in an office. The best backup is one you sit on the top off.
    - nr2x 3y ago
      I literally have a Linux machine that I’m ready to rig up were it not for Comcast being my internet provider. Maddening to live in “Silicon Valley” and be dealing with dog shit data caps and speeds.
    - Aldipower 3y ago
      This does not pay out in Germany due to the high energy costs in private house holds or office spaces.

thatwasunusual 3y ago

> Never figured out how to use Hertzner. Wanted to try since they get such a good reputation on here, but they banned my account when their system presented no way for me to verify my identity. Is this something new? I (Norwegian) have been using Hetzner for 10+ years, and never had a problem, and never had to attest my identity. CurrentlyI have a four servers running there. The last one was set up approx. a year ago, IIRC.

Havoc 3y ago
>I (Norwegian) That may be the difference. Some nationalities get KYC'd easier than others and they seem to take it very seriously
- kldx 3y ago
  +1 anecdatum
- rejectfinite 3y ago
  There is a reason :)
jsnell 3y ago
It's definitely not new, they required an id 20 years ago. (From EU citizens, so it's not about the country either).
- dividedbyzero 3y ago
  For what it's worth, I have a VM on their cloud offering and I've never had to provide them with an ID.
- thatwasunusual 3y ago
  So how do you explain that I never have had to show an ID?
  - detaro 3y ago

deleted 3y ago

[deleted]

EVa5I7bHFq9mnYK 3y ago

I think they really care about two things: VAT and cryptocurrency. Passports are required to prove you should or should not pay the 19% VAT, and crypto (namely, SIA) destroy their servers.

yrro 3y ago
Whoa whoa whoa I can opt out of paying VAT? How do I do this!
- EVa5I7bHFq9mnYK 3y ago
  That's exactly why they have draconian KYC measures in place)
- mjochim 3y ago
  Have a company whose business purpose justifies spending company money on servers. Make a profit so you have company money to spend. Spend it on servers. There you go.
- marcosdumay 3y ago
  You prove you don't reside on the EU, and they don't bill you the VAT. (But I believe the KYC rules aren't only because of this.)
  - yrro 3y ago
    You got my hopes up but it seems I'm stuck paying UK VAT even though I don't think it's necessary any more. I've run into this with a few different German businesses, I don't know if I'm right or they are, but it seems like they don't _have_ to charge me VAT. Which is underlined by the huge "import VAT" bill I'm dumped with when I have physical goods delivered to me in the UK.
    - robjan 3y ago
      They do have to charge you VAT unless you are a VAT registered limited company

nixass 3y ago

> The required either PayPal or passport I had similar struggles with some non-IT service providers in Germany. They couldn't fathom why I have non-German nationality, German address and driving license from third country. Passport, German address and driving license all have different address on them (all three being EU addresses). It is apparently huge red flag in EU in 21st century. Incredible

2000UltraDeluxe 3y ago
You have an address on your passport? I can see how that could cause issues if the address isn't valid. If I'd have to determine if your order was fraudulent or not, I'd err on the side of caution rather than risk having you abuse my server infrastructure (in the case of Hetzner).
- datenwolf 3y ago
  A lot of people confuse the passport (Pass) with the national identity card (Personalausweis). There's no place of residence stated on the German passport, but it is part of the Personalausweis. Since German citizens by law are required to own a Personalausweis (there's no mandate to carry it around, just having it somewhere in a drawer suffices), practically all businesses in Germany do rely on the Personalausweis to validate identities. And of course if the place of residence stated on the Personalausweis doesn't match the actual place of residence this is going to trigger some red flags.
  - andix 3y ago
    This is a very German thing. I’ve never seen ID cards from other countries that include an address of residence. Also the obligation to own an ID card is a very foreign concept in most other countries. I had that issue with German companies before, especially those who rarely deal with international customers. For example in Austria only a few people own an ID card (most people have a passport, but not everyone). So the german companies were very surprised when I gave them a copy of the Austrian ID card, that also doesn’t have an address on it.

sunshadow 3y ago

[dead]

unixhero 3y ago

Use a VPN connection to the UK when you verify... BOOM solved

2000UltraDeluxe 3y ago
Using a VPN is one of the easiest way to get rejected. Most automated systems flag stuff coming from them as highly suspicious due to the sheer amount of crap coming through them.
- unixhero 3y ago
  You can run your own from a vps and an ssh socks proxy.

andix 3y ago

They probably suffer from a lot of sign ups with fake IDs and with criminal intent. So I get that they are rather strict. Another thing to consider: cloud providers are not very interested in individuals as customers. They usually want companies as customers, that also buy more than a 3$ vserver. A solution for this problem could be a sign-up fee (50 or 100$), to pay for an extended manual vetting of customers, that is then added to the account balance.

pid-1 3y ago
> Another thing to consider: cloud providers are not very interested in individuals as customers A key theme in the "cloud vs data center" story is that most public cloud providers (AWS, etc...) were really easy to sign up, requiring a CC and nothing else. Meanwhile, hardware vendors wouldn't even talk to you as an individual / small business.
- HansHamster 3y ago
  Tried to sign up for gcloud a couple of months ago using my >12 year old google account. Long story short, while I technically managed to sign up, I never managed to get my GPU quotas increased to anything above 0, support is non-existent and contacting sales (which seems to be the 'official' way, but is only really intended for business customers?) never got a response... Meanwhile, my small server (not Hetzner) has been running for many years without any issues, never had to send them anything after I signed up...

JacobiX 3y ago

Their compliance process is quite abysmal. This is actually exactly what happened with us. After creating a new account with the intention of exploring the ARM64 services, our account was unexpectedly suspended. I contacted them to have information on the specific concerns regarding my customer information and the reason for deactivating my account. Unfortunately, we did not receive any response to our inquiries.

qwertox 3y ago

> I have no PayPal account, and their 3rd party verification system only allows passport from your country of residence (signup requires providing a contact address and they pre fill using this address; you can’t change the passport country) Sounds like a good thing to do? My current hoster in Germany made a surprise call and asked me what the name of the hotel near the address I provided was. This after I submitted the order and before they accepted.

aent 3y ago

I provided them with my passport and all the other documents they requested and they still banned me with no recourse, so yeah, their signup process is the worst I have ever experienced.

kornhole 3y ago

You get a good range of options at a low cost with Hetzner but need to identify yourself. Many hosting companies have different levels and types of verification these days. If you want to avoid any KYC, checkout https://kycnot.me/services#VPS https://kycnot.me/services#VPS.

miduil 3y ago

> Never figured out how to use Hertzner. Wanted to try since they get such a good reputation on here, but they banned my account when their system presented no way for me to verify my identity. I ran into the same thing as well, maybe my real name sounds a bit funny to their system? It was very discouraging to move forward after being instantly banned. I reached out to them how I could verify and the only way was sending them an unencrypted mail with my Passport copy. Upon request they suggested I could simply send them a fax. Note, this has been some years ago and I've never gave Hetzner a new try. As long as I can see from professional experience, you will have a lot of back and forth with Hetzner support, which becomes quite bad the moment your team is international because they'll always manage to sneak in some sort of German text. It really feels antiquated having to go through support for basic server hardware debugging. Eventually they'll often resort to replacing your instance.

MrMan 3y ago

[dead]

lmarcos 3y ago

That's why I don't use Hetzner. I don't really want to handover my passport to any company. How come digital ocean doesn't require that?

kyriakos 3y ago

I use credit card and was never asked for a passport. That's odd. Been using them for more than 5 years.