confirm email or email verification later?

Question

I have a registration form, name, email, password. I also offer the Facebook connection and in the future all other Open ID ways but for now I would focus on the regular process:

Currently, I require the password confirmation and then I send an email to confirm the email address.

But I really also like the Tumblr way which grants full functionality even without email confirmation, and so with your email+password entered you are into the site in literally 30 seconds...

So my question is: what are the best practices and in terms of metrics/stats if it is better to allow an easy process but with the risk of high volume of fake, wrong, incomplete accounts OR ask more initially so those users who complete the process are "quality users"?

(I hope my question was clear, sorry for my English.)

Answer 1

i'd opt for an instant login (and also a verification email), but with limited privileges until the user confirms the email address.

Answer 2

I personally like StackOverflow's way. Now, I don't know the process SO uses for creating an account w/o OpenID/OpenAuth, but the OpenID/Oauth is easy peezy. Additionally, OpenAuth allows for you to recieve this information, preconfirmed by the OAuth provider, if the user allows (so you'd better sell them on the allow button). Then, as the user contributes (sites define what contribute means) to the site, you gain more privilages.

Answer 3

For starter, Tumblr's site requires more than just any email/password, the email must not be in the database already and you must not have a cookie in your browswer saying you've already created an account; if you've got the cookie, the site automatically logs you in. Guessing that they also limit the number of accounts created per IP per set amount of time; but I'm not able to easly test that since there's a CAPTCHA. Which leads me to the CAPTCHA, after you submit the email/password info, it requires you to pass a CAPTCHA, in this case one by reCAPTCHA; which is now owned by Google.

Before I add additional information/analysis... would you please link to the site in question, so I'm able to get a better idea of the data input and functions provided, or just state them if that works better for you.

Analysis:

• (1) ISSUE: If a user enters the wrong email by mistake, or on purpose -- and forgets either the password or the bad email for the account, they're locked out, and cannot access there account. RESULT: This would lead to unhappy users, more support contact, etc. SOLUTION: Require email confirmation.

Thanks!

Answer 4

Seems the main question you need to ask is what's contained in the authenticated view once the account is set up with the username and password.

This can take two forms an empty shell or a representation of the person populated with personal information that is already held by the service in question.

Most examples given so far I'd class as shells, in that other than the username and password there is nothing held in the account. In these cases if there's no usage after a period of time it's probably worth purging the account and this would remove misreporting and overheads that might be a result of storing inactive accounts.

If the account provides access to already held information then email verification adds an additional security step against account access. In this case ultimately it will be how risk adverse you organisation is.