6

I am building a website that will allow companies to sign up and post information and have an internal network, but what is the best way to verify that the person that is filling in the sign up form really belongs to the company they say they do, as I don't want Joe Bloggs signing up saying he works for company XYZ when really he doesn't.

Is there a logical way of doing this or is it an impossible task?

Improve this question
3
  • 1
    A you searching for a pure digital way or are physical solutions (i.e. sending letter) okay? – Martin Aug 8 '11 at 9:52
  • Ideally purely digital would be better as can then be completely automated – Mike Norgate Aug 8 '11 at 9:54
  • 2
    They sign-up for free? Sending a bill is a great way to verify people. – JeffO Aug 8 '11 at 12:23
20

You have a few choices:

  • You can check the domain of the E-Mail address, and verify that it belongs to the company. Then send a validation email to the address which requires the holder to confirm his sign up request.

  • If there's no email adress, you'll need to contact the company and ask them to verify the sign up.

  • You can make a verified person of a company responsible for verifiying all other persons that are signing up for that company.

  • Invitation based: Alternatively it can work with invitations, then only a verified user can enable other users to sign up for the company.

Improve this answer
8
  • 2
    I think verifying the email domain is a good idea, is there any way to check the address they enter matches the address the domain is registered to – Mike Norgate Aug 8 '11 at 10:10
  • You can do a whois lookup, but it'll be hard to verify. Some registars have excluded the ADMIN-C property and then it likely can't be verified at all. Also, the addresses needn't match necessarily (for example when the company has got external IT support). In such cases, you can only verify it manually, by contacting the company. – Falcon Aug 8 '11 at 10:17
  • What would be the best way of verifying the first user then, or would some sort of manual verification, such as a phone call be a better idea although maybe not practical – Mike Norgate Aug 8 '11 at 10:25
  • 5
    @maple_shaft - I'd question a sales person without a corporate email address. Are they really an employee or some independent reseller which they failed to mention? – JeffO Aug 8 '11 at 12:22
  • 1
    Verified company representative who confirms all other users of that company is the way we do it for my firm's customer access site. It works well for us, but we have a team of about 30 people who do nothing else than be liasons for our customers' questions and issues. – KeithS Aug 8 '11 at 14:43
4

I work on a product for a company that has a similar problem and we solve this problem manually.

The terms and conditions for our site require the user to upload a signed letter from their manager stating that they are an employee of said company. Our customer service people when not taking calls will audit users in their spare time to make sure that they are not uploading a PDF of the Betty Crocker Cookbook or some such nonsense (true story).

While this doesn't sound ideal it is the only way to 100% verify the validity of the persons claims without performing a background check, and this validity is critical to our business process.

Another way we justify the time and cost of this approach is to make it a unique selling point to our customers that we personally review all user profiles (eventually) for accuracy and completeness.

I would think that if it were easy to digitally do this with 100% certainty then there would be little need for businesses that perform background checks.

Improve this answer
2
  • 2
    Not that this will only stop low-level attempts. Its not hard to get a copy of or fake a letterhead. – Freiheit Aug 8 '11 at 13:52
  • 1
    @Freiheit, SHHHH!! Don't tell my customers! ;-) – maple_shaft♦ Aug 8 '11 at 16:41
2

Let other people from the same company flag them. Obviously, this means that your data is going to be as good as the size of your active membership, but the same was true of Wikipedia or indeed StackExchange. If you can get your name out there somehow, which you will need to do anyway, you will be fine.

One thing though: it will help your cause if people can flag/vote anonymously. I've seen a lot of reviews of individuals on LinkedIn which are absolute garbage, they've clearly just been done because someone has been asked and it's easier to be nice than tell the truth.

But I too have to be careful. I wouldn't flag something as garbage if I thought the person could see it; at least while I still have to work with them.

Improve this answer
2
  • 1
    OTOH possibility to anonymously flag/downvote makes it easy to throw mud on others, again making the whole data set unreliable. – Péter Török Aug 8 '11 at 10:07
  • 2
    @Peter: Yes, but other options rely on the company allowing you to post, so you'll never get anything negative. So you have to be a little imaginative. What stops people throwing too much mud here, or on Ebay, or so on? (Honestly, I suspect a large part of the answer is that people generally don't feel that need unless provoked) – pdr Aug 8 '11 at 10:20
2

Verification process many times is a bidirectional process, that is, part A claims something, part B poses a riddle in response (like asking for user name and password, sending a verification Email, etc.), part A solves the riddle. This is the only way that B can get sure A is what he claims to be. The most simple case is authentication where you are asked to provide user name and password for a website.

But authentication for an employee of a company is not possible without a third party, which in this example is the company owner, and of course, first you should trust company owner. For example, consider IBM as one of your clients. IBM CEO signs up in your website and you become sure that he/she is the real CEO of IBM. From now on, since you trust this third party, anyone coming to your site with the claim that he/she works for IBM, can be verified with the help of CEO.

Your business requirement is just like Certificates. A visitor to site foo.com wants to get sure that the site is trustworthy enough for online payments. How visitor can get sure about this? He sees a certificate notification at the address bar (in case of HTTPS protocol). But is that enough? Of course not. Because up to here, there are only two parties involved in the verification maze and second party (website) can claim a certificate. The only brilliant point here is that, visitor should trust a third party to verify the certificate of the website foo.com.

Improve this answer
0

Digital signatures already provide such an infrastructure. They're traceable to root authorities, and can be used to prove that X really belongs to a company. Here, X can be a secure website, or a Windows application, but you can trivially extend that to mail addresses. Because they're standard technology, you don't need to develop as much tooling yourself.

Improve this answer
1
  • 1
    Are you suggesting to challenge the users by requesting they send in a digital cert and/or signature? This sounds like an obvious security problem, with all the recent compromises, I wouldn't trust any third party with my digital certs. – Ramhound Aug 8 '11 at 12:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.