Membership Verification

I'm not sure if this is the place or forum to do this but I'm working on a project where I'm hoping I can have members register with the site, using their Name, Date of Birth, and MembershipID, and then contact a web service to verify that this person actually is a member? I'm not interested in any details about the member, or membership, a simple boolean true/false for the submitted data would be just awesome.

Tremmorkeep wrote:I'm not sure if this is the place or forum to do this but I'm working on a project where I'm hoping I can have members register with the site, using their Name, Date of Birth, and MembershipID, and then contact a web service to verify that this person actually is a member? I'm not interested in any details about the member, or membership, a simple boolean true/false for the submitted data would be just awesome.

There isn't an official written policy that I can point you to about this. However, the current word from Church employees is that we should not store an sensitive membership information on non-Church web servers.

This could prove problematic to your project. Is it really necessary for you to verify they are a member?

I do like your idea of a web service of some sort that can be hit by the outside world to verify that information. I just don't think it is ok for you to be storing that info on your own servers.

Nah, I dont want to store anything other than their logon...storing personal data (like DOB, Name, SSN, etc) is WAY beyond any liability I wish to carry. BUT my site, to maintain the integrity of the data, would need to verify that the person on the site is in fact, a member of the LDS Faith, regardless of standing.

mkmurray wrote:However, the current word from Church employees is that we should not store an sensitive membership information on non-Church web servers.

If I understand it, it's an issue about uploading other people's information. A member entering their own information is another story.

That said, I don't think there is currently such an application available for use outside the church. It's an interesting idea, but I also think there's a potential dark side as well. Other then for law enforcement purposes, I'm not sure of any protocol for the church to confirm the membership status to any outside party.

Of course, there's probably ways to achieve that goal by somehow passing the information to a church website and seeing how it reacts. Which may be a concern.

RussellHltn wrote:If I understand it, it's an issue about uploading other people's information. A member entering their own information is another story.

I don't know...For some reason I'm under the impression that I don't even have rights to distribute my own membership number outside of Church sites/servers.

mkmurray wrote:I don't know...For some reason I'm under the impression that I don't even have rights to distribute my own membership number outside of Church sites/servers.

"rights" is a strong word. I would think anyone has the right to distribute any information about themselves to anyone they wish to.

But in the case of a membership number, there's an educational issue. Most people understand that it's not a good idea to hand out a Social Security Number to anyone who asks for it. I doubt if they understand the issue behind disclosing a membership number.

So, I would agree that we should discourage members from disclosing their membership number and confirmation date to others. But I don't think we can prohibit it.

Likewise we should probably discourage any third parties from trying to gather that specific information.

RussellHltn wrote:"rights" is a strong word. I would think anyone has the right to distribute any information about themselves to anyone they wish to.

But in the case of a membership number, there's an educational issue. Most people understand that it's not a good idea to hand out a Social Security Number to anyone who asks for it. I doubt if they understand the issue behind disclosing a membership number.

So, I would agree that we should discourage members from disclosing their membership number and confirmation date to others. But I don't think we can prohibit it.

Likewise we should probably discourage any third parties from trying to gather that specific information.

Especially since those two numbers (Membership and Conf Date) can allow you access to that person's ward information and then the malicious party would be able to get information about the entire stake.

It would be possible to verify if someone has an account with the church by passing through the church username and password and seeing if it successfully logged into the site. Problem is that no one should give out that information anyway.

Verifying that someone is a member through a web service can be beneficial (like a LDS only networking site) but also potentially abusive as mentioned by Russell where one can start harvesting this information for their own purposes.

Best way (and probably the only way) is to see if the church will host your idea. You can start by explaining your idea here if possible.

thedqs wrote:Especially since those two numbers (Membership and Conf Date) can allow you access to that person's ward information and then the malicious party would be able to get information about the entire stake.

Or use it to access the new Family Search and create havoc there.

But let's talk about the main issue - verifying membership. Can anyone think of a time when the church has verified that someone is a member in the "normal" world unless it was part of church business? Isn't confirmation/denial itself a privacy issue?

thedqs wrote:It would be possible to verify if someone has an account with the church by passing through the church username and password and seeing if it successfully logged into the site. Problem is that no one should give out that information anyway.

Verifying that someone is a member through a web service can be beneficial (like a LDS only networking site) but also potentially abusive as mentioned by Russell where one can start harvesting this information for their own purposes.

Best way (and probably the only way) is to see if the church will host your idea. You can start by explaining your idea here if possible.

Current Church policy is that sites should not ask users to enter in their account information (username/password/membership #/etc) even if they want to pass it through to lds.org. The problems are obvious. Malicious sites could crop up.

The idea of having an API or web service program can access through some federated security approach is a project we are exploring now. Until then, there is no way to do it.

Current Church policy also asks that people do not create web sites for official Church work. For example, ward web sites, etc. However there is no limitation on creating web sites for personal use (for example, dating sites, user groups, etc) as long as local units do not promote such sites.

Tom

So how would the API work? Would it Similar to facebook's or google's where the developer must get issued a developer's key so that he has access to the API? (In which case only those developer's authorized by the church could access the API).

thedqs wrote:It would be possible to verify if someone has an account with the church by passing through the church username and password and seeing if it successfully logged into the site. Problem is that no one should give out that information anyway.

Perhaps this is why the New Family Search site has a captcha on the registration page. Although, that will only make it difficult to use the page in such a manner, not prevent it completely.

Interesting... I was wondering why they did that.

Aaron

cannona wrote:Perhaps this is why the New Family Search site has a captcha on the registration page. Although, that will only make it difficult to use the page in such a manner, not prevent it completely.

I'd think the captcha would discourage trial-and-error attacks. If a web site is trying to convince a member to enter their information, then I'd think it would be easy to get around the captcha just by forwarding it to the end user.

Captcha prevents a lot of automated attacks and registrations (usually why they are included on registration pages) but as Russell pointed out it wouldn't stop an attack that passes through the picture.

thedqs wrote:So how would the API work? Would it Similar to facebook's or google's where the developer must get issued a developer's key so that he has access to the API? (In which case only those developer's authorized by the church could access the API).

Nothing has been definitively defined but from the discussions I've been involved in, it would be similar to Facebook. Apps would have to register with the Church and then at the Church level, we could kill access to data from apps that we find are being exploited.

Tom

I was wondering if there has been any progress on a web service to allow third-party web sites to verify information given by its members to confirm they are a member of the church? Our website is only for LDS Church members and we want to make sure the LDS Church members feel secure.

Ideally we would like to pass Membership Record Number and Birth date to a web service. The web service would ideally return a true or false.

I would really appreciate any information or direction anyone could provide.

Thank you,
Spencer

expertis wrote:I was wondering if there has been any progress on a web service to allow third-party web sites to verify information given by its members to confirm they are a member of the church?

Personally, I doubt if the church has any interest in creating such a API. Except to cooperate with law enforcement, I don't believe they verify membership in any other situations, so I don't think they'd do it as routine for other websites.

There is a program to work with third parties on FamilySearch. You'd have to go thoguh the whole process to become a vendor with them. You can find more details at https://devnet.familysearch.org.

RussellHltn wrote:Personally, I doubt if the church has any interest in creating such a API. Except to cooperate with law enforcement, I don't believe they verify membership in any other situations, so I don't think they'd do it as routine for other websites.

I believe the church considers the simple fact that a person is a member to be personal data. Of course your application wants to confirm information that the member is choosing to share with you. In my opinion OpenID and OAuth could by implemented by the church to allow third party access to information, but leaving control of that access to the individual. As long as only information about that individual (and possibly the household they head) is shared, I see no reason for the church to be concerned about the use; however, I also see little motive for the church to invest the needed resources. The OpenID and OAuth pages would emphasize that the information was being shared with a third party that is NOT endorsed or affiliated with the church in any way.