Ask HN: Why not we fight bots by verifying identity?
11 comments
Verifying identity is highly intrusive and would hinder quite a lot of desirable activity. I don't think bots are such a huge problem as to be worth paying that steep of a price.
I may be a little off topic, but I wanted to provide a special sample. In China, Weibo is fully real identity verified, but there is only more thorough manipulation of speech on there. Real people afraid to voice would make bots more effective, not less.
I live in a country where just liking the wrong tweet risks the chance of jail. In places like that NOT having a verified identity is desirable.
Fighting bots is only about ensuring you are a unique human being. It need not be about revealing your identity. I think the problem is what organisation would be willing to authenticate you without any benefit to itself.
I'm all for it, but there are a few reasons why we typically don't from my perspective:
- UX: verification is often an onboarding step that makes getting going with whatever app or service you're trying to use that much harder. And what happens for false negatives? Now you're locked out with a potentially lengthy and unfruitful support case process
- Regulatory: To verify identity you usually need to capture a lot of personally identifiable information. With increasing legislation around how to store, control and use such data safely, it's just too risky for many businesses to try to capture this
- Cost: where a business MUST capture this info, they will either use a third-party service built for purpose or invest heavily in their own infra to do it - both are cost-prohibitive for general adoption + support costs for handling issues with false negatives etc
- Privacy: not everyone wants to be identified online. If you could detach verification from identification then you'd be onto something but that would take some serious coordination between an identity management provider, a verification service, your app AND the end user - that's a lot of points of failure and headache compared to customer<->app
- UX: verification is often an onboarding step that makes getting going with whatever app or service you're trying to use that much harder. And what happens for false negatives? Now you're locked out with a potentially lengthy and unfruitful support case process
- Regulatory: To verify identity you usually need to capture a lot of personally identifiable information. With increasing legislation around how to store, control and use such data safely, it's just too risky for many businesses to try to capture this
- Cost: where a business MUST capture this info, they will either use a third-party service built for purpose or invest heavily in their own infra to do it - both are cost-prohibitive for general adoption + support costs for handling issues with false negatives etc
- Privacy: not everyone wants to be identified online. If you could detach verification from identification then you'd be onto something but that would take some serious coordination between an identity management provider, a verification service, your app AND the end user - that's a lot of points of failure and headache compared to customer<->app
Anonymity has so many advantages that bot spam is a small problem in comparison.
Many government currently try to outlaw hate speech. This is technically bad and dangerous legislation that will hit innocent people, so not being identifiable is desirable.
Whistleblower get imprisoned even in countries that call themselves democracy.
Some annoying bots are the smaller problem by some extend. I get that public figures might want their identity verified. But that is an edge case.
Many government currently try to outlaw hate speech. This is technically bad and dangerous legislation that will hit innocent people, so not being identifiable is desirable.
Whistleblower get imprisoned even in countries that call themselves democracy.
Some annoying bots are the smaller problem by some extend. I get that public figures might want their identity verified. But that is an edge case.
We haven't heard much about Twitter bots since Musk took over. This points to bots not being a real problem, but rather an issue Musk was pushing as part of the deal finalizing process.
You assume real people want to have their real identity verified. Probably many won't complain but I'm one of those who prefer not to end up in such place where my real identity is verified in order to be able to use services on the internet.
Not sure why you get downvoted, maybe bots problem is huge problem that should make users concerned? As for me, when facebook tried to force me to send scan of my ID over email in order to unblock my account I decided I benefit more by not unblocking it :) Facebook way was probably the wrong way to ensure your users are real human beings, but either way I like not to be verified when online.
I would love to answer your question, but first send me your photo and your real name.
To avoid having a toxic / bot / spammy online environment in different places, why don't we just verify each internet user's real identity in either a centralized / decentralized way?
It's not difficult to do identity verification nowadays - if you try to sign up for one of the scooter apps for instance, they'll verify your government ID. Some other services will use your face to know it's actually you, etc.
If we only allow signups to certain services (Twitter is one example) if someone has verified their real identity, doesn't that by default get rid of most bots? (barring criminal identity theft).
Would love to get your take!