itch.io Community » itch.io » Ideas & Feedback

Verified badge on profile if you use a card in proper name to purchase anything on itch!!!

A topic by tinspin created Jul 12, 2025 Views: 619 Replies: 11

Viewing posts 1 to 4

We need more trust on itch, because steam signs the executable people blindly trust that platform.

One cheap and effective way would be to add a verified badge to profiles that made a purchase with a card in their own legal name.

That way if someone uploads a virus itch can send the real identity to the police in that country. Not that the police cares but you know for a trust boost as now anyone can create a profile without buying anything and host viruses on the platform?

Of course this means you have to be really careful of not getting hacked AND maybe some sort of 2FA would be good?

Like Reply

redonihunter262 days ago

2fa will not protect against cookie theft attack.

Scammers will fake everything if it increases trust. If Itch uses a cheap verification system, they will fake that, or simply use hacked accounts again. Seen hundreds of those. Any new verification system would need to meet the quality standards of the existing verification system Itch has.

Itch is fighting those criminals. You can notice this by all the complaints of developers about being quarantined. But there are still too many fake projects and scams published each day. Users do trust those scammers, that's the problem. I have seen fakes with over 50 followers.

I sure wish there would be an easy solution. New developers need trust, else no one would ever try their games.

Like Reply

tinspin262 days ago (3 edits)

But when you use your card, itch gets your real name. How can they exploit that, creating fake real people? Visa/Mastercard do not have safequards against that?

I meant 2FA as additional protection against someone getting access to your acount after you have been verified.

So maybe gold badge would be verfied card + 2FA, silver = verified card, bronze = 2FA?

OR gold = $100+ purchases, silver $50+, bronze $10+? That way it's really expensive for hackers to cheat.

Like Reply

redonihunter262 days ago

Asking people to verify their account by paying some kind of fee, that might even be refunded, would work to some extent.

It would work a lot less effective, if you use user level verification to verify developer accounts. For one, the hackers have access to hacked accounts that will have made purchase. So rich hunting grounds to just grab pre-verified accounts. A special transaction would be better. But if there is no grace period for fraudulent transaction, yes, they can easily invent fake people to pay for with stolen credentials. They already fake email adresses in bulk. Using a list of stolen credentials that might work for a few weeks is not that difficult. They are not after the money itself from those cards, they just need it to hold long enough to put up a fake account with a shelf life of a few weeks. Also, the verified account check mark might lull users into installing the malware and ignoring any warning messages. So higher effectivness that justifies putting more effort into faking the page plus verification.

2fa for a verified account is as easily broken as for a non verified account. Get your session cookie stolen and your account is compromised for uploading malware. An easy countermeasure would be to ask for the 2fa token when uploading or updating a project. I do not know if Itch has such a thing, I assume not. You have several projects and probably 2fa. Were you ever asked for your 2fa for doing a thing that a hacker might do? Like exchanging files against virus infected files?

I do not know how Itch currently verifies developers. They can do it, and there are accounts with a verfied checkmark. For example, Hempuli is verified. You will find more here https://itch.io/games/top-rated

Like Reply

Evolutionary Games262 days ago

How would Itch.io know that you're using your real name and real card, and not a stolen identity or stolen credit card?

Like Reply

tinspin262 days ago (4 edits)

That is a question for Visa/Mastercard/Governements. if the card API says "this name is a legal person and not some prepaid card" itch has to trust it... Good luck to hackers crating multiple fake cards and spending $100 to get a gold badge and trick 5 people!

Its actually very simple to promote real persons over hackers... account activity over 5 years with 100+ downloads, Commenting on the forum replying with non AI answers. Etc. Filing VAT paperwork. Taking out money to an account that matches your card name and is not flagged as criminal. etc etc etc forever.

Like Reply

redonihunter262 days ago

I have some experience and opinions about this topic of fake accounts and malware and scammers.

A while ago, older accounts were very popular to upload malware. I literally have seen those in the hundreds. In a few months.

The problem is, that Itch wants a low entry bar. Which includes not needing to pay "large" sums to even be able to publish something. Steam asks $ 100 upfront. I think they reimburse the dev after the account sells things. And they do a little more than just verify that the developer is real. I do not know the procedure that Patreon has, but I got the impression that it takes time. Maybe money as well. But Itch does not want to lock out developers and hobby game makers that cannot afford or literally can't send those payments.

Also, are you suggesting a mere increase in verified accounts or basically a strict verification for all publishers? Because a mere increase in verified accounts will not solve the problem of fake pages. There are more than enough legit developers that will not be verified for the scammers to hide among. The developers that would be able to get verified usually do not need to. If you have a few hundred followers and an active community, there is trust. No checkmark needed.

You need trust for unknown and new developers. But this will not be possible on the cheap. The pragmatic solution is to use sandbox. Either by playin a web game or by using a sandbox system on the user's computer. The Itch app provides a poor man's sandbox. One can wonder why such a feature exists in the Itch app...

Anyone that is in doubt about trusting a new developer should use a sandbox, just in case. There are other things an amateur developer might screw up on your system without intention. The sandbox should at least safeguard browser cookies.

Like Reply

tinspin261 days ago (7 edits)

If you had read my other comments here you would not be asking these questions. A badge that makes sure users feel safer and hackers have to use a real name card on itch and spend money and wait, to successfully spread malware. It does not hurt newcomers by blocking them, but newcomers have to buy into getting the badge; it makes old users more trustworthy as they should be.

Sandboxing is the solution if you think the browser is a solution, and it ain't looking good I tell ya. Java had sandboxing for 30 years nobody used it, outside of applets, except me; not even Minecraft modders. So I'm making my own JVM to fix that since Oracle foolishly removed the sandbox in the latest Java version... in the meantime we have to embrace native (or close to native performance/featured VMs like Java/C#, js can't do efficient memory sharing between threads without copying f.ex.) because of power usage: Linux on ARM is the only viable platform long term and until we get a better sandbox than V8 (even with WASM) that will not work.

Time is trust, you want to remove the breaks to go faster. That's an accident waiting to happen.

Like Reply

redonihunter261 days ago (2 edits)

So? Is this supposed to be mandatory to publish or is this supposed to be an option to have such a verified checkmark? You began your suggestion with Steam as an example. Steam does not have an optional way to verify developers. They verify all of them. And because they verify all of them, there is trust.

If it is an additional option to get a verified checkmark, it will not change the situation. Some games would have more trust, all the rest would still not have such a checkmark and be a hiding place for all the bad uploads.

The sandbox mode I talk about is on operating system level. It separates the user that runs the game from the user that normally uses the system. That's why I called it poor man's sandbox. The game user can't read the files belonging to the regular user.

Time is trust, but time is not trustworthy. I have seen malware that was indexed for two years. Several that were indexed half a year. And I saw hundreds of hacked accounts that were several years old and being used to upload malware. And it happens far too often that Itch will not remove reported malware for several weeks. Nope, time does not make a game trustworthy.

Like Reply

tinspin261 days ago

It would be automatically shown once the itch user uses his card to buy something on the site.

And once time passes with more purchases and comments it could level up.

But yes upload security needs to be increased = IP validation, 2FA and maybe even virus scanning.

Like Reply

redonihunter260 days ago

... so something that appears on some accounts. Mostly user accounts that do not publish anyway. Itch does have a verification system already. But they only use for very few accounts.

IP validation does not do much good. If Itch would react to reports within hours they might do something with that information for bulk uploads, but the scammers change IP a lot.

2fa does absolutely nothing here. Neither for new fake accounts, nor for older hacked accounts. And Itch does scan files, but their scanners are not up to the task. Again, if they react within hours and update their scanners within hours and scan older files ... that might do some good. The Itch scanners are so bad, I had downloaded files that even old Windows Defenders outright deleted without asking, so clear was the scan result. But then again, some malware I found did not even trigger a single scanner on virustotal. It is trivial for the bad uploaders to circumvent the Itch scanners by trial and error.

Believe me, I sure wish that there were some changes that would make spamming viruses and scams onto Itch a waste of time for the criminals. It makes me sick to see them every day. But the method you suggest would not solve this issue.

It would solve another issue, but only for long time users turned developers at that. As I said, the trust in the Steam platform is only, because they verify each developer. So to increase trust in Itch, there would need to be verification of all uploads. If you only attach a verified symbol to some few accounts in an automatic manner, those few accounts might be trusted a little bit more, till the criminals find ways to fake the verification process.

Like Reply

ashleyharvey19250 days ago

The idea of linking a verified badge to real-name card purchases makes sense on paper, but it’s a tricky balance. I get the need for trust, especially with rising malware cases, but verification systems can be spoofed too. I'd rather see stronger moderation tools and mandatory 2FA for uploads. Trust should come from transparency, not just badges or transactions.

Like Reply