1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Add-on Phone Verification For Upgrades (or Registration)

Discussion in 'Resource and Add-on Requests' started by tenants, Nov 21, 2012.

  1. tenants

    tenants Well-Known Member

    Would any be interested in a phone verification system for account upgrades (I may also extend this to registrations).. It will use an external site to make the calls (something like Twilio .. who I believe charge $0.04 per text)

    It's useful if you have many people upgrading with fake credit cards / cancelling upgrades after they pay

    On visiting the Upgrades area, if the user has not verified by phone they are presented with a form to enter their phone number. On entering their phone number, they are sent a text with a simple code, if they successfully verify the code, they then have access to the upgrades area.

    I'm currently working on this add-on, and thinking of selling it at £25 each?
  2. HWS

    HWS Well-Known Member

    I would buy such an addon if it works for registration also. Even would pay more.
    Maybe you want to take a look at Clickatell. That is what we use for automated text messages.
  3. tenants

    tenants Well-Known Member

    I've started with Twilio, but I can look at adding options for using alternatives...
    HWS likes this.
  4. Mouth

    Mouth Well-Known Member

    It would be *AWESOME* to see this Add-on.
    I would also like to request that other Custom User Fields be made mandatory for upgrades. Thus, for an account upgrade definition, tick the boxes of Custom fields that are required to be completed during upgrade.

    * Bonus Points, or Stage 2? - Allow the user to purchase (via account upgrade processing) SMS credits, and every delivery of an SMS decrements their balance or SMS credits by 1. SMS's are sent for user defined triggers (via their account settings) provided they have credits available.
  5. Mouth

    Mouth Well-Known Member

    Double Bonus points :) - use Authy for 2 factor authentication.
  6. musixman

    musixman Member

    I will purchase.
  7. tenants

    tenants Well-Known Member

    I'm looking at this, I've made it so that it also works with Clickatell

    It currently works with the Account Upgrades (since this is the area that forum owners are likely to have fraud issues)

    Screen Shots here:

    <It's not released yet>

    It could be used on registration to prevent spam too, but how would you imagine it to work with registration?

    Keep in mind, if bot account attempts to randomly fill this with real phone numbers, the SMS will be sent and you will still be charged for it (and they could keep doing this, switching IP addresses / username / emails)

    Inside the account upgrades, we wont have such a problem (since you can limit the total SMS's an account can use, and prevent duplicate phone numbers etc)

    Would you see this as an addition to CAPTCHA on a registration page?
    Would this be within an iFrame on the same registration page, so that users also have to authenticate their phone number before registering

    One idea I had is that the registration page wouldn't be available until the phone authentication was complete, on authentication, this would make the registration page visible and send an expiring authentication key (this key would need to sent on to the registration page and verfied) .. but this wouldn't stop bots from attempting the phone authentication
  8. HWS

    HWS Well-Known Member

    It should work like it works at Facebook. They usually know what they are doing. :D

    General registration should be possible without verification via SMS. You are correct, it is not possible to secure that with SMS verification.

    However the admin/moderator should be able to set certain accounts manually to "SMS verification necessary". Those members should be displayed a form to verify their account before they can continue to use the site.

    I cannot see the screenshots at your site, because of missing permissions (even after login). :(
    When will you release this addon? I'm in a testing mood. ;)
  9. tenants

    tenants Well-Known Member

    ohh.. good point, I rely on those view permissions so that people can't download the plugin without paying <tut>

    added screen shots here:

    Account Upgrade Fraud Work Flow Screen Shots
    phonev_1.png phonev_2.png phonev_3.png phonev_4.png

    Forum Spam Work Flow Screen Shots

    phonev_spam1.png phonev_spam2.png phonev_spam3.png phonev_spam4.png phonev_3.png
    ACP Screen Shots
    PhoneVerify_ACP_logs.png PhoneVerify_ACP_options2.png PhoneVerify_ACP_perms.png
    Dan and Luis like this.
  10. HWS

    HWS Well-Known Member

    Thank you. Looks good. But 999£ is too much. :D
  11. tenants

    tenants Well-Known Member

    This would imply it would be permissions base (which I was planning on doing), so you can allow certain groups through with out needing to phone authenticate.. or manually let some users through, or just target certain users and force them to phone authenticate.

    This wouldn't work as just an overlay (they're easy to get around), so what it sounds like you are suggesting to "block" certain users from everything on the site until they have phone authenticated (not just the upgrade area) ... and this page would potentially be seen straight after registration (which is safer to control)

    Probably before the end of the week
    HWS likes this.
  12. tenants

    tenants Well-Known Member


    It will be £25...
    I've set it to an insane amount until it's ready
  13. HWS

    HWS Well-Known Member

    Group based would be perfect. Users in the wrong group should be blocked until verified.
    Please notify me when you release it, I would like to buy it as soon as it is available.

    This is what I've thought. ;)
  14. tenants

    tenants Well-Known Member

    Okay, so I can scrap the registration idea... I can't see a safe way of doing it

    But a post registration form is looking likely

    "your account first needs to be authenticated by phone, before the forum options can be unlocked"
    << and this will have to override potentially every type of page
  15. tenants

    tenants Well-Known Member

    I've now added a version (PhoneVerify 1.2.0) with an ACP option that forces a user to Phone Verify (site wide)

    This means after registration, the user will be presented the phoneVerifiaction Page, no matter where they attempt to visit - note, this is optional.. you can still apply phone verify to the upgrade area only if this is more appropriate

    This version is also permission based (options to "canByPassPhoneVerify" can be applied to groups that you trust)

    I'll add it to the resources once I've played with it for a day... but if you want to test it, it's now been reduced to the sane price of £25:
  16. Digital Doctor

    Digital Doctor Well-Known Member

  17. HWS

    HWS Well-Known Member

    Thanks, already bought and I'll test it soon. :)
  18. tenants

    tenants Well-Known Member

    found a bug with the Account Upgrades option (I didnt add the permisions helper).. easy fix, I'll update it in 10 minutes
  19. tenants

    tenants Well-Known Member

    okay... fixed and testing it now version 1.2.1

    I'll add it to the resources tomorrow if I don't find anything else

    I think Twilio give you about $10 to test with
    Clickatell only give you 10 sms's to test with
  20. tenants

    tenants Well-Known Member

    I'm not sure their model really fits this

    It seems they require phone authentication every login ... I don't know how many people this would appeal to for fourm software :S

Share This Page