trial account SMS confirmation problem

[paul29]

I tried signing up a trial account for my mom earlier this month. Apparently trial accounts now require SMS confirmation. My mom doesn't use SMS so I put in my own number, which (if it matters) is actually a VOIP endpoint that forwards SMS to my email. After multiple attempts I never got any of the SMS codes--the signup page said a message had been sent, but nothing arrived, and no error message. It's possible FM is refusing to use the number since it's not an actual mobile phone (I prefer VOIP forwarding for multiple reasons) but if that's what's going on, 1) it's annoying; and 2) there should at least be an error message saying what the problem is.

Any advice? FM staff, would you be ok with manually enabling my mom's account if I ask through a ticket from my own account? I can vouch that she's not a spammer (she can barely even email me from Yahoo).

Aside: maybe the SMS confirmation is needed to stop botnets from signing up multiple accounts with automated or human captcha farms but it's annoying and invasive. I'd have thought limiting new trial accounts to 5 or so sent messages/day would prevent most spam problems. I also see the backup email address is no longer needed, and trial accounts can still receive email with no confirmation of any kind. This turns FM into a Mailinator-like service with 2 month retention in a manner of speaking, if you know what I mean. I'm not sure at all if that was intended.

[goky]

I understood there were no trial accounts anymore.

[robn]

Originally Posted by paul29

After multiple attempts I never got any of the SMS codes--the signup page said a message had been sent, but nothing arrived, and no error message.

Unfortunately all we get is that it our SMS provider (Twilio) successfully sent it to the SMS network. SMS isn't itself a reliable delivery mechanism (much like email) and there's no real way to know if it was delivered or where it went.

Any advice? FM staff, would you be ok with manually enabling my mom's account if I ask through a ticket from my own account? I can vouch that she's not a spammer (she can barely even email me from Yahoo).

Yes, please PM me with her account details.

Aside: maybe the SMS confirmation is needed to stop botnets from signing up multiple accounts with automated or human captcha farms but it's annoying and invasive. I'd have thought limiting new trial accounts to 5 or so sent messages/day would prevent most spam problems. I also see the backup email address is no longer needed, and trial accounts can still receive email with no confirmation of any kind. This turns FM into a Mailinator-like service with 2 month retention in a manner of speaking, if you know what I mean. I'm not sure at all if that was intended.

Our experience is that botnets sign up thousands of accounts at a time and only send a single message, so even a tiny sending limit wouldn't help.

We're about to make some other changes to unverified accounts as well, including blocking non-web services and certain components in the web interface, and stripping links from incoming messages so unverified accounts can't be used for fake signups to third-party services.

The basic idea is that an unverified account can't really do anything except looking at basic features and receiving an email or two. Note that an unverified account is not the same as a trial account - once you verify your account (by SMS code or payment), then the account becomes verified and your get the remainder of your trial period with a fully-active Enhanced account.

[paul29]

Originally Posted by robn

Unfortunately all we get is that it our SMS provider (Twilio) successfully sent it to the SMS network. SMS isn't itself a reliable delivery mechanism (much like email) and there's no real way to know if it was delivered or where it went.

Hmm, ok, though I do get SMS from other senders at that number. Sounds like a Twilio issue.

Yes, please PM me with her account details.

Will do, thanks!

Our experience is that botnets sign up thousands of accounts at a time and only send a single message, so even a tiny sending limit wouldn't help.

I guess they programmed past the old approach of requiring an existing email address to enroll a trial account. That means you're big enough to attract that level of technical effort, so I guess you should feel encouraged ;-).

The basic idea is that an unverified account can't really do anything except looking at basic features and receiving an email or two. Note that an unverified account is not the same as a trial account - once you verify your account (by SMS code or payment), then the account becomes verified and your get the remainder of your trial period with a fully-active Enhanced account.

Hmm, that limits the usefulness/accessibility of trial accounts by enough to probably to get in the way of FM's growth, but it's up to you. Being able to use a full-function, unverified (except for backup email address) trial account for a while was a big factor in getting me to sign up as a paid user. I hope you can converge on something that keeps the bots away while not making too much of a barrier to human enrollment.

Anyway thanks for the explanations and the help, I'll PM my mom's account info shortly (I need to get it from her computer).

[robn]

Originally Posted by paul29

Hmm, that limits the usefulness/accessibility of trial accounts by enough to probably to get in the way of FM's growth, but it's up to you.

Our data suggests its not a problem at all.