Why would OVHcloud need this to setup a $10 Linux VPS
Posted by lolitsaj@reddit | linux | View on Reddit | 52 comments
I've hosted with many different VPS providers but have never seen this kind of thing. Their services aren't anywhere near good enough to be asking for this kind of overreach for a $10 VPS.
Has anyone experienced this with OVH or other VPS hosts? I told them to cancel the order because of such a stupid request.
deanrihpee@reddit
probably since they're "OS providers" now? idk, at least we can thank the lawmakers for this
nekokattt@reddit
no, it is just to stop fraud and spam by forcing you to give information you wouldn't want to give if you were making 15,000 burner accounts to spin up crypto mining software.
Mother-Pride-Fest@reddit
You're not going to profit by mining on a $10/month VPS.
nekokattt@reddit
you are if you make enough of them and are not paying in the first place
AutoModerator@reddit
This submission has been removed due to receiving too many reports from users. The mods have been notified and will re-approve if this removal was inappropriate, or leave it removed.
This is most likely because:
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.
MelioraXI@reddit
I personally use Hetzner and can't recall ever getting a similar request.
Mother-Pride-Fest@reddit
Don't send your ID to a random company. Just ignore them and find a different VPS provider.
Nunwithabadhabit@reddit
Jesus yeah, fuck this shit. Everyone else is complaining about having to choose their age from a drop-down and then these motherfuckers are hoovering up PII. I highly doubt it's being deleted after use - probably sitting in a folder somewhere.
moanos@reddit
It's a European company, so I'd assume this is deleted.. otherwise hefty fines are very likely. You can also request a copy of your data at any time to check.
Nunwithabadhabit@reddit
I do GDPR requests at work...trust me, it's not accomplishing it's purpose and it's entirely self-reported. Small/medium businesses almost never get hit with GDPR fines because they aren't profitable - it costs more to fine than it makes, and so many people are doing it wrong that if they enforced everything they'd go flat broke in days.
moanos@reddit
I get that not everything is perfect but I'd argue that even if loops exist, it's unlikely that OVH keeps records of this - why should they? Especially if you ask for your data, they will for sure remember to delete the data they are not allowed to keep.
OVH is one of the companies where I'd be pretty sure a data protection ministry (or whatever the French equivalent is) would be very willing to fine as the risk is pretty high and they have enough revenue and they are aware of the risk..
Mother-Pride-Fest@reddit
They are requesting this info by email. If they follow the default for email records then the ID would be retained and backed up, not deleted.
jar36@reddit
what do you mean about complaining about choosing their age from a drop-down?
Nunwithabadhabit@reddit
Right now the Linux community is very riled up about age gating - being forced to indicate our age when we do things. It's split the community and alienated users from some major distros.
And then there's whatever the fuck these VPS people are doing with your PII.
jar36@reddit
tbf one is just to use your own computer and the other is to use a site where one could do a lot of nefarious things, getting them into trouble
Those folks are mad about the idea of a drop-down box in Linux distros, but that isn't what was really proposed.
The systemd-homed merge was specifically to get the bdays to comply with these laws.
The project leader from Fedora said that these signals do not comply with the laws. No one asked him why
If you read the law, it is clear that they rely on online user accounts. In their world, getting a new device and setting up an account involves a 3rd party such as Google, Apple or M$.
The signal is also supposed to follow you across devices by the law. That is to say, if you get a new device and login with that user account, then the signal from the operating system PROVIDER or covered application store (these stores are already tied to the OS provider so no need for separate process to set up the account. it just carries over) will be the same on the new or borrowed device.
They don't even think about local accounts.
They are the lynch pin of the entire operation.
That's what the community should be up in arms about.
There is no way 99% of the distros could comply even if they wanted to.
These online accounts will need an email at minimum to be able to confirm the account and to be able to communicate with the account. Usually, these accounts get more info like phone numbers, contacts, calendar events, gps data and more. Of course, that much data isn't necessary, but people willingly give that to Google for the most part. Some needs to be disabled by the user.
If the letter of the law, the statement from Fedora, and what I've said so far isn't enough, then look at what the people who debated and voted on the law said. The CA Senate Judiciary Committee said only the device manufacturer gets that information. They later changed manufacturer to operating system provider or covered application store so the onus wouldn't be on, let's say, Samsung.
Google was against these laws, then the language changed and now they support them. It's basically enshrining a duopoly in the smartphone market as if their grip wasn't tight enough. It's why they've made it so hard to side load and why Windows is phasing out the local accounts
One can also look to the statements of distros like Puppy Linux, who mention the lack of central user accounts as their reason to "ban" CA
The corporate backed/adjacent distros know this but aren't saying it straight out. The fedora project leader came the closest. He knows for a fact they do not satisfy the law, but decided to sit on why that is.
Jan 1, 2027 will be here sooner than it seems, and expect to see users of mainstream products having to deal with it by Nov. That's about when I expect the truth to have to be openly discussed
The law in IL specifically calls out non-profit operating system providers to not get an exception.
They're literally banning linux and no one but the folks who spoke to attorneys sees it coming. Those folks have corporate backing. I don't want to speculate tho. I'd like to think we're all in this together, but someone should have said something to us by now about what these lawyers are telling them. It's been 6 weeks already since they started announcing they were going to do that.
sorry, this went on a lot longer than I had planned
KervyN@reddit
They have extra buildings to store them, and after a certain period they just burn it :-)
/s
Disclaimer: I work there them and the CISO doesn't fuck around. I doubt they keep it.
Vynlovanth@reddit
I made a new account last month for a VPS as well, got the same email. Was immediately turned off. 3 days later the transaction went through anyway even though I didn’t do anything.
moanos@reddit
It's a typical problem as OVH cloud, Hetzner and similar providers attract spammers and scammers. It's a sad reality that this is necessary. A provider you could try to stay anonymous is Uberspace, they even take cash (via mail). Be aware that they have good monitoring and will not tolerate immoral behavior in any way.
Frosty-Cell@reddit
If monitoring is capable of achieving a similar result, it seems this excessive amount of personal data is not necessary.
Novero95@reddit
Maybe requesting data is cheaper than monitoring.
Frosty-Cell@reddit
Processing personal data is subject to regulation. It comes with requirements that are unlikely to met if there is a less intrusive alternative.
Groogity@reddit
I’ve used Hostringer and Hetzner and never been asked for more than payment information.
moanos@reddit
Same for me with Hetzner. But if you were to use a VPN for example they would probably ask for ID.
Groogity@reddit
I did use a VPN, I’m in the UK and have a habit of using a VPN to avoid using my ID. Seems inconsistent from reading other comments, perhaps there’s various factors that are considered automatically.
S7emCell@reddit
I have a vps with ovh and they didn't ask me for ID.
moanos@reddit
Same for me with Hetzner. But if you were to register at OVH with a VPN I bet they would ask you to provide an ID.
S7emCell@reddit
Makes sense
Klutzy-Condition811@reddit
Fraud prevention.
azraerl@reddit
It is funny though - fraud prevention looks like a fraud by itself.
dualboot@reddit
This request usually comes down from the upstream payment processor.
SpeedDaemon1969@reddit
It's identity theft! Do not comply!
QuantityInfinite8820@reddit
Because they flagged you as high risk. Based on country or credit card details in most cases.
I am glad I don’t have to deal with this as an old customer of both Hetzner and OVH with an old trusted account
CallMeRudiger@reddit
This is the real reason. Something about the transaction seems higher risk, so they'd rather lose OP's business than risk them abusing the service or committing fraud that gets them dinged for a chargeback.
Among other things, some triggers might be: - Billing address mismatch - Tried to use multiple cards - IP address does not geolocate near the billing address - VPN use
NotQuiteLoona@reddit
Maybe, you could try Hetzner? Using it right now, didn't ask me for anything. Also really cheap.
TestingTheories@reddit
I opened one up with Hetzner today, got asked for ID or Paypal to open the account.
NotQuiteLoona@reddit
Strange. It didn't even ask me to pay for it, I just selected PayPal as my payment method, and it didn't ask me to do a payment before giving me a server, I'm yet to see my first payment.
Frosty-Cell@reddit
Presumably because Paypal does the KYC.
NotQuiteLoona@reddit
It didn't even ask me to do a payment, that's the thing.
Frosty-Cell@reddit
It's extremely unlikely this information is needed to "process your order", which is the stated purpose. GDPR requires data minimization and a legal basis, amongst other things. This processing does not appear to comply with that.
I think the requirements are intrusive and excessive enough to justify filing a complaint with the data protection authority.
DFS_0019287@reddit
Wow. I have an OVH server and don't believe I was ever asked for anything other than an email address and a credit card number. But I'm hosted in Canada, not the USA.
However, I set up my server quite a while ago... around 2016 or so? So maybe the rules have changed in the interim.
natermer@reddit
Yes. This is stupid.
Don't put up with this sort of crap.
semi-@reddit
Probably KnowYourCustomer laws.
tabrizzi@reddit
If those are what it takes, I won't even bother.
Straight-Software-89@reddit
Run on big tech free tier like oci
KervyN@reddit
Maybe ask at /r/ovhcloud :-)
Hot-Employ-3399@reddit
Yes. Hetzner did it already in 2013
I moved to other vps as I didn't want to submit my passport
lolitsaj@reddit (OP)
Wow that is WILD for 2013
TestingTheories@reddit
I opened one up with Hetzner today, got asked for ID or Paypal to open the account.
lolitsaj@reddit (OP)
Paypal would be totally fine by me. I just don't want to do a multistep verification process just to have my ID stolen later by hackers haha
Kevin_Kofler@reddit
Hetzner is a lot less of a PITA there. In my case, all they needed was my name and my IBAN (international bank account number, basically a worldwide system except for the USA and a handful other weird countries). I think the SEPA (single European payment area) deduction system does not work in the US though, only within Europe. But the usual credit card data should be sufficient then, without this absurd level of identity checking.
TestingTheories@reddit
I opened one up with Hetzner today, got asked for ID or Paypal to open the account.
Gallardo994@reddit
Lots of servers are rented by throwaway accounts for scam and/or botting purposes. Still sucks though, as many providers perform checks only when they are actually suspicious of your account.