#7868 Phone verification system

v1.3.0
closed
Igor Bondarenko
sf-8 (45) 42cc (432)
General
Dave Brondsema
2015-08-20
2015-04-06
Dave Brondsema
No

To control spam and other abuse, a phone verification system could be useful. This would be optional for any Allura instance to use, of course.

Initially I'd like to see this on project registration. The ProjectRegistrationProvider can provide methods to allow flexibility in different deployments. A default implementation could be as follows. The first time a user registers a project, they will be shown a followup screen requesting a phone number for either SMS or voice verification. (If a user has any existing non-deleted projects, this will be skipped and registration occurs as normal). Verification occurs (see next paragraph). If verification succeeds, record that on the user record so they won't have to verify again, and add a user audit log too. Use a non-salted hash of the phone number, do not ever store the full number. Then project registration actually occurs. If verification fails, record an audit log also. Let the user try again.

For actual phone verification, we should set up a simple abstraction layer to allow different verification services to be used. See the "spam.method" config and SpamFilter classes as an example of that type of setup. Specific implementations could include Twilio, Nexmo Verify, etc. These classes could be used for different situations later too (e.g. two-factor login)

Site-specific messages will need to be included in this too. E.g. saying the phone number will be used for verification only and will not be stored; or if they are having problems how to contact support, etc. Simple text could be handled with a config setting, more complex with a template override.

Don't need to apply this to project imports.

Discussion

  • Dave Brondsema

    Dave Brondsema - 2015-04-06
    • labels: sf-current --> sf-current, sf-8
     

  • Igor Bondarenko - 2015-04-23
    • labels: sf-current, sf-8 --> sf-current, sf-8, 42cc
    • status: open --> in-progress
    • assigned_to: Igor Bondarenko
     

  • Igor Bondarenko - 2015-05-12
    • status: in-progress --> review
     

  • Igor Bondarenko - 2015-05-12

    Closed #759, #760, #761.

    {allura,sftheme}:ib/7868

    QA:

    Enable phone verification and config Nexmo in production.ini:

    project.verify_phone = true
phone.method = nexmo
phone.api_key = XXX
phone.api_secret = XXX

     
    You can register Nexmo account here. By default it's working in test mode, so only phone number used to register account can be used for verification (you can whitelist more numbers for testing in account settings). You'll also get 2€ credit for testing.

    UI implemented using React.js as discussed in this thread.

     

  • Dave Brondsema

    Dave Brondsema - 2015-05-21
    • Reviewer: Dave Brondsema
     

  • Dave Brondsema

    Dave Brondsema - 2015-05-21
    • status: review --> in-progress
     

  • Dave Brondsema

    Dave Brondsema - 2015-05-21

    Some feedback so far. I have some more testing yet to do too.

    • add react.js to LICENSE and Allura/LICENSE and rat-excludes.txt
    • in phone-verification.js the function definition syntax is not quite right for isInputDisabled & isButtonDisabled
    • NexmoPhoneService docstring doesn't need the "to enable" section
    • The phone number is being logged, we don't want that. Could log the hashed version though. Probably shouldn't log the api secret either
    • I'm thinking it would be useful to include hashes in the user audit logs.
    • And for the hash, can we "canonicalize" it so its easy to check for a match if needed? I'm thinking stripping any non-alphanumeric chars (like whitespace and punctuation).
    • phone_verified() should return True if user already is an admin of a project, so existing developers aren't affected when this is enabled. (That could be implemented in a SourceForge-specific provider, but seems reasonable to include by default)
    • I'd rather have phone validation kick in after someone tries to submit the form, not right at the beginning (it might discourage more people). Can the overlay appear as part of the form submit?
     

  • Igor Bondarenko - 2015-05-27
    • status: in-progress --> review
     

  • Igor Bondarenko - 2015-05-27

    Closed #776, #777. Force-pushed allura:ib/7868

    Also, sf-related changes on forge-classic:ib/7868.

    QA:

    Make sure that when popup is shown it preserves all values on original form. One exception of this is sf-specific "terms" checkbox. It's fine, since form doesn't care about it and it's validated only by js before form submission.

    Make sure it works with local registration provider. I ran out of money on my Nexmo test account and didn't get a chance to test registration end-to-end for local provider. Partial testing tells me it should work, though.

     

  • Dave Brondsema

    Dave Brondsema - 2015-05-28
    • status: review --> closed
     

  • Dave Brondsema

    Dave Brondsema - 2015-05-28

    There are some additional tweaks/enhancements I'd like to see but I'll do those as followup tickets, this is good.

     

  • Dave Brondsema

    Dave Brondsema - 2015-06-01
    • labels: sf-current, sf-8, 42cc --> sf-8, 42cc
     

  • Igor Bondarenko - 2015-06-18
    • Milestone: unreleased --> asf_release_1.3.0
     

Log in to post a comment.