ybceo

If I understand correctly, this is the flow you are describing :

1. You show your ID to a "trusted third party"

2. They cryptographically attest "yep, this person has valid government ID"

3. The service (Discord, Coinbase, etc.) only gets the yes/no assertion, never sees your actual docs

The third party would still have your documents. You've just moved the honeypot, not eliminated it. Discord's breach was through a third party. Signzy (a KYC provider) got breached. The whole article is about how third parties can't be trusted either.

You're right, we shouldn't have had those certifications listed. They've been removed. We're a new company, made a mistake, and we're fixing it. Appreciate you calling it out.

I went ahead and took action on the criticism as soon as I saw the parent comment. All apache access logs are piped to /dev/null now.

I'm not here to debate, the reason I posted here is to hear what people thought and see how I could improve my platform based on the criticism.

I disagree. Like I said earlier :

Web server logs were not tied to user credentials in any way, they were used for debugging purposes and could not have been used to identify users.

Those data points refer to what is stored in the database and is tied to your 32 character credential.

Web server logs were not tied to user credentials in any way.

I agree 100%. I went ahead and disabled all logging in Apache just now. Will update the privacy page to reflect this within the hour.

I was going to say making the platform open source might solve this problem, but then users would have to trust that we are actually running the open source version and not some fork with logging and tracking. This would be an interesting problem / paradox to try to crack.

But you are 100% right, I will look into alternatives for Cloudflare, which we are using because it seems like the cloud hosting industry LOVES to DDoS new players.

You're thinking about browser fingerprinting (client-side), but my post is about service-level anonymity (server-side).

Browser fingerprinting: "Your unique combination of extensions/settings makes you identifiable among other users."

Service anonymity: "There are no other users to compare you against because we don't collect identifying data."

When you sign up with just a random 32-char string, there's nothing to fingerprint. No email to correlate. No IP logs to analyze. No usage patterns to build a profile from.

Fingerprinting matters when services collect behavioral data. We architected our way out of having that data to begin with.