I guess this is a multi-part question. I am building a membership site and want to have the accounts as international as possible.
What is the best way to collect phone numbers on a form that allows for international numbers? I'm not worried about storing them, just collection and validation. What I have now is a drop down with a country list that will add the country code, and then the number itself with validation for us/can/uk based on the country code, and then the extension. These will be stored as strings in 3 fields for cc/number/ext Does anyone have a better, solid solution for this, or perhaps seen one in action anywhere?
Ditto for addresses. What is the best way to go? Address/City/State/Zip/Country or just lines? I would like to be able to sort by these, so a single text field isn't a very good solution, though it is the most flexible.
This is also important because we may be sending actual mail to our members. I am put in mind of a few members I've had for other services that had addresses in countries I had never heard of, that even the woman at the post office couldn't tell if they were formatted correctly.
I want to have geodata in the db, at least country/state, for things like populating a state dropdown after selecting a country, field standardization, etc. Does anyone know of a great database that can be used as the geodata base of an app?
Phone number validation - I'm not sure if I'd spend a lot of time on this. Numbering schemes change quite often (for example, during the time I lived in the UK, the phone numbers for London area codes changed at least once, with another change shortly before I moved there) and in Germany it is (or at least used to be) quite common to increase the number of available phone numbers on a given exchange by taking an old number and tacking an extra digit or two at the end. So any assumption about a given phone number format will change and you'll end up playing catch-up. If you insist on splitting the phone number into international/area code/main number you'll probably find that this is a very country-specific way of representing the information so you'll need an input mask pretty much for every country and specific validation rules. Not to mention that in places like Germany, an area code can have between two and four digits etc...
Regarding postal addresses, the most important suggestion I have is to ensure that you can accept non-numeric post/zip codes, otherwise you won't be able to handle addresses in Canada and the UK (and possibly other places). This is a bit of a hobby horse of mine as I've had a few issues with websites in other countries that simply refused to let me put in a non-numeric post code and I had to resort to faxing over my address information as I couldn't fill in the online application form. In my book that's bad karma if you allow international customers....
Also, assuming the existence of certain parts of the address (state/county, for example) and requiring them is usually more of a headache than it's worth. I'd be tempted to offer the standard house number + street (combine them, different languages put the house number in different places so separating them out is not a good idea IMHO unless you know how to reassemble them correctly, plus sometimes you'll end up with a house name instead of a number), town and zip/post code, possibly with an optional county/state field. If you want to be really helpful to you international audience, offer a free-form, single text entry field for those addresses that don't conform to our "standard" assumptions of how an address looks. And please make them big enough so people with quite long addresses don't run out of space...
There is an international standard for telephone numbers, but it leaves a lot of breathing room. Separators are not mandatory, but are restricted to space, period, and hyphen. Round brackets (aka parentheses) are to be put around digits which are optional depending on where you are dialling from. For example, the area code is optional in some areas. I would provide a text field and let the user enter their number however they want.
For addresses, provide lots of fields and don't restrict too much. House numbers sometimes contain letters. Road types are sometimes written in full, and other times abbreviated. (St = Street, Ave = Avenue, etc.) I would provide drop-downs where possible (state/province), but allow freeform input when you don't have a list. When the user is entering their address, it's ok to validate for security risks, but you might want to leave geographical validation until later. For example, if the user enters a postal code of T8N 4E3 and selects Ontario as their province, the address is not valid because the given postal code is for Alberta. Display a friendly message to the user letting them know that they need to correct their address or contact you if it's correct (possible bug in your code).
Address - just remember not everywhere you got states and ZIP codes. and if you got ZIP codes they can be in diffrent format ([0-9]{2}-[0-9]{3} here). (edit: usually postal address with 2 address lines, city, state (optional), zip code (optional) and country is ok).
So is with geodata - you can make sequential dropdowns with states and cities but guess you won't cover every city. Why not show a piece of google maps and allow the users to click there to mark their position?
Related
I'm aware of the Luhn algorithm for validation of payment card numbers.
However, is there something similar that will tell me whether a particular card requires a start date or issue number, as these aren't universal?
Using this information, I would then show or hide the start date and/or issue number input boxes once a customer has entered their payment card number.
As far as I know, no there is no way to detect whether the expiry date (I assume that's what you meant by start date) is required based on the card number.
In these kind of situations (i.e. special cases for different cards), I've turned to this site as well as the backing data. With this data, you can get the bin of a credit card from the first 6-8 digits. I'm skeptical as to whether even the bin contains the data you are looking for, but good luck!
Just a note: be wary of the data since it is open source. In my experience it has been accurate, but make sure you keep that in mind. There are enterprise solutions to get bin data if accuracy is that important to you.
Suppose we have an event and we want to prove that the event occurred after a particular date, we have a few easy ways of doing so. For example, one may just show a snapshot of a newspaper with a particular date and headline, indicating that the event is at least after that day. Or we could put in the ending stock price in a particular exchange of a particular date to say that it was after the end of trading hours of that day. This could be as fine grained to the second after the time when the exchange closed.
How to do the converse ? How can one say that an event occurred before a particular point of time ? One could depict large events (skyline of NYC to show various before or after WTC) and geological changes, but that is a very large-scale measure. Is there a much more fine-grained way to depict the fact, of the granularity of a few hours or days ?
Hash up the information you need to preserve (e.g. with a https://en.wikipedia.org/wiki/Merkle_tree) and publish the resulting hash value openly. This doesn't disclose any usable information, but if you later need to prove precedence, you can disclose the values you hashed up to show you had the information at that time.
I heard a story of AT&T paying for newspaper advertisements, long before computer security was mainstream, which disclosed a hash value. After a while the paper became worried that they were publishing mysterious advertisements every day that looked like secret codes and AT&T had to explain to the newspaper what the function of these were.
(A web search finds https://www.newscientist.com/article/mg13318103-800-technology-computer-fraudsters-foiled-by-the-small-ads/ including
Bellcore began running its advertisements in the New York Times in October
1991. They were interrupted for several months when newspaper employees
became suspicious of their cryptic contents. ‘Somebody said, ‘These look
like codes. You might be telling a terrorist to kill somebody,’ says Haber.
Fortunately for Bellcore, the Times’ computer correspondent persuaded the
newspaper to allow the advertisements back in.
Beware - article is buried in CSS and cookie notifications and inline ads)
I am trying to create a health application of a rather sensitive nature which will require some form of cryptography/obfuscation. There is a health study in which once a year, known individuals with permanent and recognisable identifier numbers (eg KIG0005001 as an individuals identifier) walk into the clinic, are identified, have their blood tested as part of a study. Next year, the same happens again, as this is a longitudinal study. Now the results of the blood test should NOT be able to be traceable to an actual individual (HIV status, etc are highly sensitive bits of information that should not be linkable with actual individuals due to their right to privacy), but it is IMPERATIVE that we can identify year on year which blood samples belong to one unique individual (without knowing WHO the individual actually is, the emphasis is on the blood samples being traceable to one individual, not the individual).
My idea (and here is where am asking for your expertise in cryptography and obfuscation) is that when the individual visits the clinic they come with an identifying card with their regular id number KIG0005001 . This number is entered into a system where via an algorithm/encryption it spits out a barcode (based on the original id KIG0005001 , therefore any future visits should produce the SAME barcode for a particular individual) which can be printed out as stickers. These barcode stickers are the ones to be used to identify the samples (stick em on the samples). The stickers should have the following information in them: unique identifier (via barcode?), the round number that the sample was taken (samples will be taken once a year, so year 1= round 1) and date sample taken.
Is this possible? What are the alternatives? How/What should I do in terms of transforming KIG0005001 into an encrypted barcode which is repeatable year on year (so blood sample can always be traced back to the same source). Am programming in Java.
Thanks in advance,
Tumaini
To answer this question, I don't think it needs to be in the barcode section.
First of all, there is no way to keep everything 100% secure... but you can make it more complicated to be understood by a human.
It's the same thing as the passport controversy... A biometric passport must be secure: it's not possible to read the information without knowing the "private key". But let's say you read and record everybody's passport that enters your store and save it to a database. You will be able to trace who is coming back and even what they previously bought since you have their passport's ID...
To make the life harder for your employees, you need to generate an ID that will match the real person's ID. So if the employee is testing the blood of KIG0005001, they will receive a different unique ID for that day; the computer will know how to link them up. So that your employee has no idea who is this number at that moment...
Cryptography is probably useless here since you work with IDs. Even a gibberish data repeated multiple time is still an ID.
I am looking to implement a simple registration key system. There will be printed codes, and we'd like users to type their code into our system.
This code will be used around the world, and we want to avoid any problems with confusing codes.
We're already doing the following:
using numbers and upper case letters
leaving off 2 and Z, Q and 0 and O, 5 and S, B and 8, U and V, and 7 and 1 and I
breaking up the code into four-digit chunks, so it's easier to digest
Is there better guidance online about common printed registration code pitfalls? I know this can be an annoying process for users and I want to make it as easy as possible in my system.
Put it on a durable, movable medium
Things that annoy me are
weak paper stickers glued permanently to hardware
small labels you don't know where to put
There is no ideal format, really. I'd suggest something similar to a business card - durable paper, in a size for which "containers" (carry boxes, folders, laminating cards) are readily available.
Allow Copy & Paste
Make sure I can copy and paste the key as a whole.
Your input should of course indicate the groups of characters, but when "Paste" only transfers the first group, I am a very unhappy customer.
Barcode
If you stick to print mostly, consider adding a bar code. Depends on your customer base, but it's a worthwhile option if some of them are already expected to have a barcode scanner, and might be expected to enter such a number more than once.
Unfortunately, they are much longer than the numbers, so that might be a format issue. (If you make it to small, scanners won't recognize it, if you make it to big hand scanners can't read it).
For mobile apps e.g. on a phone with camera, you could use image recognition of one of those fancy "square barcodes". (I'd expect libraries for that to be readily available).
Do you insist on print?
Allow the keys to be stored in a (e.g. text) file, give them a specific file extension that is registered for your program.
This way, you can attach a licence to an e-mail, the user just double clicks the attachment, gets a message box
Do you want to install the following licence:
dnord's GreatApp Pro - Evaluation licence (30 days)
[yes] [no]
We use a modified system to (a) have additional data in a licence file, and (b) bundle multiple licences (for separate modules/apps) into one package that can be installed at once.
At least it's an alternate to entering a key for each purchase, welcomed especially by our larger customers.
We never had support calls because of problems receiving or installing the custom file type, though this might be different if you have a consumer product. At least, no support calls because of mistyped keys :-)
General
Have a plan how to deal with "lost licences".
There's no recipe here, I guess with pure software solution you might have to show some lenience to not alienate paying users.
(We usually bind to 19" rackmounted hardware that's hard to lose, so we happily create new licences for a customer as often as he likes).
With the age of text messages and things like that, what's a good way to store phone numbers in a database?
In the USA, text messages are handled by phone numbers but in other countries I hear they use email addresses so I guess there needs to be a way to differentiate between countries that use cell phone numbers as their address.
Addition:
For example, people in the USA might use 432-342-3333 or 1-432-342-3333 while in the UK they might use +44 800 400000 or they might even leave out the 44. The 44 and the 1 makes a difference when automatically sending out SMS. However, checking the phone number for each country can get tedious. In this case, would you split the country code or would you merge it into a single column and deal it with it there?
I would primarily use a text field, or a series of text fields, even if you are using a numerical phone number for the following reasons.
Phone numbers have a great range of values, including extension numbers which may result in numerical columns losing precision.
Losing precision in a phone number is rather bad.
There is no logical reason to want to perform math ( addition/multiplication ) on a phone number.
Additionally, you may want to specify how you are using this data. If you are planning an automated messaging service, you're going to need a series of relaying agents to broadcast via, so you may as well add an identifier that pertains to the relay the information pertains to. Then all you have to worry about is that the relaying agent can understand the content in the text fields.
Generally as text, you don't need all the fancy formatting, unless you need it to parse numbers from different countries that you can't distinguish otherwise. You can always add the formatting later on.
Not as a number!!! Leading zeros may be problematic.
I don't know if you have read these two questions, but they might help you a little.
Phone Number Columns in a Database
Is there a standard for storing normalized phone numbers in a database?
Perhaps it would be wise to store the type of number (landline, cell, fax) and/or the messages that can be received on it (voice, text, email). Note that in the US, it is also possible to send text messages to a phone via email, but I believe that is dependent on the carrier.