up vote 11 down vote favorite
5
share [g+] share [fb]

I have a registration form, name, email, pass. I also offer the Facebook connection and in the future all other open id ways but for now i would focus on the regular process:

now i require the pass confirmation and then i send an email to confirm the email address.

but I really like also the Tumblr way, that doesn't require any confirmation but with your simple email+pass you are in in literally 30 seconds...

so my question is: someone know what is the best practice and in terms of metrics/stats if is better to allow an easy process but with the risk of high volume of fake,wrong,incomplete accounts OR ask more initially so those users who complete the process are "quality users"

i hope my question was clear, sorry for my English.

link|improve this question
feedback

4 Answers

up vote 15 down vote

i'd opt for an instant login (and also a verification email), but with limited privileges until the user confirms the email address.

link|improve this answer
I was going to answer, but this is essentially the same thing I was going to say. Great answer! – Charles Boyung Oct 27 '10 at 19:03
@Quamis: Just wondering, since maybe I'm missing something, but why would you limit access based on email verification? All email verification does is allow the user to recover an account. As a measure of if the account is fake, "real", spam, etc. it appears meaningless; reason being that it's very easy to automate email account verification, especially if there's no CAPTCHA in the email verification process; which by the way, I've never seen before. Thanks, and I'm open to any reasons you may have, just would like to understand your logic. – blunders Oct 27 '10 at 19:38
@blunders - how exactly is it easy to automate receiving the email and clicking on the link inside the email to verify your account? You would have to have every one of those email accounts available to you to receive the emails with the links to click on. And exactly what is your obsession with CAPTCHA? It isn't the be-all, end-all to beating bots. In fact, almost every CAPTCHA out there can and has been beaten if you do some research. – Charles Boyung Oct 27 '10 at 20:29
@blunders - Oh, and you've never seen an email verification process without CAPTCHA? So what, have you only been using the internet for 5 years or so? CAPTCHA hasn't been widely used for that long. And I still see tons of places that don't use CAPTCHA at all. – Charles Boyung Oct 27 '10 at 20:31
@charles: captcha actually sucks, i'm pretty sure any decent programmer can fake a real user if he really needs to. I kinda disagree using cahtcha for sensitive data – Quamis Oct 28 '10 at 7:55
show 7 more comments
feedback
up vote 2 down vote

For starter, Tumblr's site requires more than just any email/password, the email must not be in the database already and you must not have a cookie in your browswer saying you've already created an account; if you've got the cookie, the site automatically logs you in. Guessing that they also limit the number of accounts created per IP per set amount of time; but I'm not able to easly test that since there's a CAPTCHA. Which leads me to the CAPTCHA, after you submit the email/password info, it requires you to pass a CAPTCHA, in this case one by reCAPTCHA; which is now owned by Google.

Before I add additional information/analysis... would you please link to the site in question, so I'm able to get a better idea of the data input and functions provided, or just state them if that works better for you.

Analysis:

  • (1) ISSUE: If a user enters the wrong email by mistake, or on purpose -- and forgets either the password or the bad email for the account, they're locked out, and cannot access there account. RESULT: This would lead to unhappy users, more support contact, etc. SOLUTION: Require email confirmation.

Thanks!

link|improve this answer
1  
Your "analysis" here (both above and below your big heading) has absolutely nothing to do with the question asked. He's not asking about CAPTCHA or other restrictions that Tumblr might use ("the email must not be in the database already" - um, duh???). He's specifically asking about one process or another. Also, I don't see why you would need to see his specific site to answer this question. – Charles Boyung Oct 27 '10 at 19:02
feedback
up vote 1 down vote

I personally like StackOverflow's way. Now, I don't know the process SO uses for creating an account w/o OpenID/OpenAuth, but the OpenID/Oauth is easy peezy. Additionally, OpenAuth allows for you to recieve this information, preconfirmed by the OAuth provider, if the user allows (so you'd better sell them on the allow button). Then, as the user contributes (sites define what contribute means) to the site, you gain more privilages.

link|improve this answer
feedback
up vote 0 down vote

I'd use OpenID with a Facebook or Google account.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.