Verify names does exactly that, verifies names. If you have verify names set to false anyone can come in with the username they want. For example I could connect to any verify-names=false server as Notch and have his yellow name + skin. If you put verify-names=true it verifies with the server the username and password, so you can't be someone without their password. If I knew who was an OP on a server with verify=names=false I could connect and play around as an OP, OP is based off of username.