Simple registration vs security

Question

I'm doing a reminding service about new episodes of series. The main idea is to make it very simple to register, like this:

The problem is about the security, I'm not using CAPTCHA nor confirming email or Twitter accounts. A bot could easily put tons of addresses and I'll be spamming them.

A much safer way would be something like sending an email with a link to confirm. And for Twitter use the login API. But that, of course, adds more steps.

Is there another way to solve this problem? Are users so used to confirming emails that it won't bother them?

Answer 1

You definitely need to confirm e-mail addresses. People are used to it and the benefits of the additional security far outweigh the "hurdle" you put up.

That being said, there are other ways to accept registrations that e-mail. You could authenticate using Facebook, Twitter, OpenID or similar services and use that for communicating to your users.

Answer 2

You need to confirm it, for some of the following reasons.

1. It is illegal to send automated mail to someone in many countries (the USA and European Union included) without them first directly opting in. That requires a confirmation email from them. In many countries the fines for sending unsolicited automated emails (otherwise known as spam) are high and can be applied per email sent. This alone is a good enough reason to confirm the emails first.
2. People often make a typo in their email address, and not only would they not get it, but you would then be spamming someone else. I regularly get email for someone whose email address is only one letter different than my own.
3. Security. Unless you know for sure that the email address belongs to a person, you can never be sure that they are the person logging in or resetting an account. Not only is this bad practice, but you also run a legal liability risk here, that you don't really want to get into.

Email confirmation is common practice, a legal requirement, and good UX.

Answer 3

I think you absolutely must confirm any email address to which you send stuff. Without such confirmation mischief and malice become much too easy.

Most people understand the necessity of confirming email addresses, and even if they find it slightly tedious they realize an important part of the process.

Answer 4

Keep this screen the same.

On clicking 'Start reminding' send them a confirmation email and let the user know they need to confirm their subscription.

You can automatically create an account with the email used and send the user a random password with a link to change it.

Answer 5

Instead of confirming e-mail you can ask for a captcha when the same ip address tries to register for the third time in less than an hour. That creates less friction on registration and less friction means more registrations. I worked in a website that used it pretty well until the mark of 2M users.

Also there are some services that provide you APIs to detect bot and spam, you can use then to choose when to display a captcha.

That obviously when you implement your own authentication, as said in other answer if you rely on FB or Twitter there is no need for it.