Ask HN: How to provide a free trial without being abused?

#1

Post by js4ever » Fri, Mar 25, 2022, 10:15 AM UTC

I've launched a few weeks ago Elest.io (fully managed open source) and we are struggling with free trials.

If we don't ask for a valid CC people from all around the world abuse the free trial and use the services to do DDOS, port scanning, and a lot of other illegal things!

When we do ask for CC legit users are turned away ... we tried to explain that we don't charge anything and it's only for fraud prevention ... but not effect.

We also tried to ask for a public social network profile to verify the identity instead of a CC but again it was not well perceived.

Is there any solution to this?

Re: Ask HN: How to provide a free trial without being abused?

#2

Post by wizwit999 » Fri, Mar 25, 2022, 10:30 AM UTC

I think you should collect CC.

Re: Ask HN: How to provide a free trial without being abused?

#3

Post by pid-1 » Fri, Mar 25, 2022, 10:47 AM UTC

- trigger warning -

Allow the whole onboarding process to be done without a CC, don't even mention that.

But when a user is doing their first deploy, tell them they need a CC to complete this step.

Thanks to the sunken cost fallacy, users will be more likely to proceed.

Re: Ask HN: How to provide a free trial without being abused?

#4

Post by hackandtrip » Fri, Mar 25, 2022, 10:53 AM UTC

UX-wise, as other said, I think it makes sense to ask for the CC as late in the process as possible: you will make your most valuable user understand how great your platform is.

Also, I think that for a platform such as yours, credit cards are absolutely a must. The risk in opening it to scammers (mining, torrent seeds, etc) is just to high; I remember reading this from fly.io [0] that explains the pain in reducing fraud.

0: https://community.fly.io/t/new-prepaid-credits-and-a-bonus-s...

Re: Ask HN: How to provide a free trial without being abused?

#5

Post by cube00 » Fri, Mar 25, 2022, 10:54 AM UTC

Limit their outgoing connections until they provide a CC number. Most software can be initially tested without needing to connect to the wider internet. Throw in plenty of /examples directories for the different applications you offer.

You could provide some approved outgoing connections to trusted plugin/package repos.

If you want to get stricter only allow incoming connections from the trial user's IP to stop them hosting scam landing pages.

Re: Ask HN: How to provide a free trial without being abused?

#6

Post by 3np » Fri, Mar 25, 2022, 10:58 AM UTC

What do you think about offering locking up some minimum amount of cryptocurrency (say, Bitcoin), which would withdrawable at the end of the trial but also being usable as payment for continued service?

One could utilize HTLCs so that the coins are locked for a predefined amount of time - so you wouldn't need to take custody of the coins during the trial but still be able to them if you decide there was abuse. If you do nothing after the initial lock-up, once the HTLC expires the user can claim the coins back again. That way there is less risk and impact of losing funds due to errors or compromise on your side, compared to just requiring a deposit going into a wallet.

As a complement and alternative for CC. I would think that the people either unable to, or not willing to provide CC out of principle, and the people comfortable with Bitcoin have a decent overlap.

Re: Ask HN: How to provide a free trial without being abused?

#7

Post by sokoloff » Fri, Mar 25, 2022, 11:02 AM UTC

Anyone who won’t give you a credit card for the free trial isn’t likely to give you a credit card later to become a customer*. In this space, giving a credit card seems perfectly normal and serves as a vetting function of seriousness for you.

* I can concoct exceptions of course: worker who wants to try it for work but doesn’t have their own company card being one. But if you’re targeting cloud users, “doing whatever AWS does to gate accounts” is perfectly reasonable.

Re: Ask HN: How to provide a free trial without being abused?

#8

Post by mkl » Fri, Mar 25, 2022, 11:02 AM UTC

Can you limit resource use after some reasonable amount? Seems like you've got the tools for that already. "Network Firewall [...] + Web Application Firewall", "IP Rate Limiter", "Alerts to detect abnormal activity", etc.

I can see why people don't want to give their credit card to someone they haven't made a deliberate decision to give money to, or to mix their social life with business. Edit: there's also the problem of trusting a company to hold onto your card data securely - I let almost no companies I do business with save the card details, and prefer to just type it in every time. Storing credit card details makes you a target, and I'm doubtful many smaller companies have the security skills to defend themselves.

BTW, "software" is not a countable word. Instead of "softwares" you mean "software services" or something.

Re: Ask HN: How to provide a free trial without being abused?

#9

Post by mpbeauj » Fri, Mar 25, 2022, 11:02 AM UTC

pid-1 wrote: post #3

- trigger warning - Allow the whole onboarding process to be done without a CC, don't even mention that. But when a user is doing their first deploy, tell them they need a CC to complete this step. Thanks to the sunken cost fallacy, users will be more likely to proceed.

No post body was provided.

Re: Ask HN: How to provide a free trial without being abused?

#10

Post by humanistbot » Fri, Mar 25, 2022, 11:08 AM UTC

pid-1 wrote: post #3

- trigger warning - Allow the whole onboarding process to be done without a CC, don't even mention that. But when a user is doing their first deploy, tell them they need a CC to complete this step. Thanks to the sunken cost fallacy, users will be more likely to proceed.

This is a dark pattern and will infuriate both your abusers and legitimate users.