Opened 4 years ago

Last modified 4 years ago

#1864 new bug

FAKE verifications

Reported by: beatnickgr Owned by:
Priority: minor Milestone: backlog
Component: BW Verification Keywords:
Cc:

Description

PROBLEM: currently, any new member can open 2 profiles, and verify one with the other, although they could have fake name/address.

SOLUTION: only people who have already been verified should be able to verify new members.

TIP1: to make sure the passport has been checked, we should verify each other with passport number instead of password.

TIP2: all the current verifications should be removed, because they might be fake.

Change History (6)

comment:1 Changed 4 years ago by midsch

TIP1 is probably illegal in some countries. And what would stop me to use a random number? There are some ways to check, if such a number is valid for some countries, but I don't think it's worth the trouble if it doesn't work with other countries anyway.

comment:2 Changed 4 years ago by planetcruiser

i agree, the current "verification" could be misleading and we should discuss this in a bigger group

comment:3 Changed 4 years ago by shevek

The use of common sense is essential for any hospex network. First question would be why would someone fake a verification? What would such person gain? A positive comment by a second profile would get so much more.

If you see a verification icon you can click on it and check the verifiers. Going from there you can include the comments of the commenters into your decision if you want to host/stay with the person.

Regarding TIP1: That would mean that we collect passport numbers because what else would we check against?

Additionally if someone only hosts s/he might not even have a passport. So could never be verified while having hundreds of positive comments. To use an instead ID is also not an option.

comment:4 Changed 4 years ago by planetcruiser

  • Priority changed from critical to minor

not critical. if abuse of this is actually reported to us, we can raise priority

comment:5 Changed 4 years ago by sitatara

Regarding TIP 1: As mentioned by others this is not feasible. However, I think it would be good to ask people to

  • confirm that they have seen an ID of the other person before they can proceed to name verification;
  • enter information about the document they used for name verification in their verification comment;
  • enter information about how they know the address is correct into the verification comment.

For that matter, I would split the verification comments in 2 parts: 1. How did you verify the name?, 2. How did you verify the address? Both fields should be mandatory and will be displayed on http://www.bewelcome.org/verifymembers/verifiersof/[username]. If that information is missing or nonsense, a potential host/guest of that person can judge for him-/herself if to trust that verification.

Personally, I think the bigger problem than intentional fake verifications are cases where people have wrong ideas about verification. Some might think verification just means that they confirm they know the real name and address of that person - no matter what they entered on BeWelcome. For example, currently it's actually possible to verify the address of another person even though he/she never entered an address on BeWelcome. So, what does address verification mean in such cases? Obviously, one can interpret it as an act in bad faith (i.e. an intentional fake verification). However, one can also assume that they just wanted to confirm that they know the address of that person. In doubt I would always opt for the latter assumption (i.e. innocent until proven guilty) and that's why I am totally against TIP 2 (which would probably also be highly frustrating for many members).

However, I like the general idea of this ticket, i.e. that the first verification should only be possible with someone who's already been verified before. It's a very simple mechanism which at least cuts out the possibility of the most simple fake verification attempts.

comment:6 Changed 4 years ago by shevek

  • Component changed from BW Profile to BW Verification
  • Milestone changed from unassigned to backlog
Note: See TracTickets for help on using tickets.