Add-on Phone Verification For Upgrades (or Registration)

[tenants]

Would any be interested in a phone verification system for account upgrades (I may also extend this to registrations).. It will use an external site to make the calls (something like Twilio .. who I believe charge $0.04 per text)

It's useful if you have many people upgrading with fake credit cards / cancelling upgrades after they pay

On visiting the Upgrades area, if the user has not verified by phone they are presented with a form to enter their phone number. On entering their phone number, they are sent a text with a simple code, if they successfully verify the code, they then have access to the upgrades area.

I'm currently working on this add-on, and thinking of selling it at £25 each?

 

[HWS]

I would buy such an addon if it works for registration also. Even would pay more.
Maybe you want to take a look at Clickatell. That is what we use for automated text messages.

 

[tenants]

I've started with Twilio, but I can look at adding options for using alternatives...

 

[Mouth]

It would be *AWESOME* to see this Add-on.
I would also like to request that other Custom User Fields be made mandatory for upgrades. Thus, for an account upgrade definition, tick the boxes of Custom fields that are required to be completed during upgrade.

* Bonus Points, or Stage 2? - Allow the user to purchase (via account upgrade processing) SMS credits, and every delivery of an SMS decrements their balance or SMS credits by 1. SMS's are sent for user defined triggers (via their account settings) provided they have credits available.

 

[Mouth]

Double Bonus points - use Authy for 2 factor authentication.

 

[musixman]

I will purchase.

 

[tenants]

I would buy such an addon if it works for registration also. Even would pay more.
Maybe you want to take a look at Clickatell. That is what we use for automated text messages.

I'm looking at this, I've made it so that it also works with Clickatell

It currently works with the Account Upgrades (since this is the area that forum owners are likely to have fraud issues)

Telephone Verification service provides a way to combat on-line fraud. This ensures that your customers provide you with a working, traceable telephone number. As a result, fraudsters are less likely to target your business.
The whole process is automated for the merchant and easy to complete for customers.

Screen Shots here:
http://www.surreyforum.co.uk/thread...tions-with-phone-verification.1734/#post-2545

<It's not released yet>

It could be used on registration to prevent spam too, but how would you imagine it to work with registration?

Keep in mind, if bot account attempts to randomly fill this with real phone numbers, the SMS will be sent and you will still be charged for it (and they could keep doing this, switching IP addresses / username / emails)

Inside the account upgrades, we wont have such a problem (since you can limit the total SMS's an account can use, and prevent duplicate phone numbers etc)

Would you see this as an addition to CAPTCHA on a registration page?
Would this be within an iFrame on the same registration page, so that users also have to authenticate their phone number before registering

One idea I had is that the registration page wouldn't be available until the phone authentication was complete, on authentication, this would make the registration page visible and send an expiring authentication key (this key would need to sent on to the registration page and verfied) .. but this wouldn't stop bots from attempting the phone authentication

 

[HWS]

It should work like it works at Facebook. They usually know what they are doing.

General registration should be possible without verification via SMS. You are correct, it is not possible to secure that with SMS verification.

However the admin/moderator should be able to set certain accounts manually to "SMS verification necessary". Those members should be displayed a form to verify their account before they can continue to use the site.

I cannot see the screenshots at your site, because of missing permissions (even after login).
When will you release this addon? I'm in a testing mood.

 

[tenants]

ohh.. good point, I rely on those view permissions so that people can't download the plugin without paying <tut>

added screen shots here:

Account Upgrade Fraud Work Flow Screen Shots


Forum Spam Work Flow Screen Shots


ACP Screen Shots

 

[HWS]

added screen shots here:

Thank you. Looks good. But 999£ is too much.

 

[tenants]

However the admin/moderator should be able to set certain accounts manually to "SMS verification necessary".

This would imply it would be permissions base (which I was planning on doing), so you can allow certain groups through with out needing to phone authenticate.. or manually let some users through, or just target certain users and force them to phone authenticate.

Those members should be displayed a form to verify their account before they can continue to use the site.

This wouldn't work as just an overlay (they're easy to get around), so what it sounds like you are suggesting to "block" certain users from everything on the site until they have phone authenticated (not just the upgrade area) ... and this page would potentially be seen straight after registration (which is safer to control)

When will you release this addon? I'm in a testing mood.

Probably before the end of the week

 

[tenants]

Thank you. Looks good. But 999£ is too much.

It will be £25...
I've set it to an insane amount until it's ready

 

[HWS]

This would imply it would be permissions base (which I was planning on doing), so you can allow certain groups through with out needing to phone authenticate.. or manually let some users through, or just target certain users and force them to phone authenticate.



This wouldn't work as just an overlay (they're easy to get around), so what it sounds like you are suggesting to "block" certain users from everything on the site until they have phone authenticated (not just the upgrade area) ... and this page would potentially be seen straight after registration (which is safer to control)

Group based would be perfect. Users in the wrong group should be blocked until verified.
Please notify me when you release it, I would like to buy it as soon as it is available.

I've set it to an insane amount until it's ready

This is what I've thought.

 

[tenants]

Okay, so I can scrap the registration idea... I can't see a safe way of doing it

But a post registration form is looking likely

"your account first needs to be authenticated by phone, before the forum options can be unlocked"
<< and this will have to override potentially every type of page

 

[tenants]

I've now added a version (PhoneVerify 1.2.0) with an ACP option that forces a user to Phone Verify (site wide)

This means after registration, the user will be presented the phoneVerifiaction Page, no matter where they attempt to visit - note, this is optional.. you can still apply phone verify to the upgrade area only if this is more appropriate

This version is also permission based (options to "canByPassPhoneVerify" can be applied to groups that you trust)

I'll add it to the resources once I've played with it for a day... but if you want to test it, it's now been reduced to the sane price of £25:
http://www.surreyforum.co.uk/forums/xenforo-plugins/

 

[Digital Doctor]

Cool !

 

[HWS]

Thanks, already bought and I'll test it soon.

 

[tenants]

found a bug with the Account Upgrades option (I didnt add the permisions helper).. easy fix, I'll update it in 10 minutes

 

[tenants]

okay... fixed and testing it now version 1.2.1

I'll add it to the resources tomorrow if I don't find anything else

I think Twilio give you about $10 to test with
Clickatell only give you 10 sms's to test with

 

[tenants]

Double Bonus points - use Authy for 2 factor authentication.

I'm not sure their model really fits this

It seems they require phone authentication every login ... I don't know how many people this would appeal to for fourm software :S