Take the 2-minute tour ×
User Experience Stack Exchange is a question and answer site for user experience researchers and experts. It's 100% free, no registration required.

During registration for my new website, I'm going to require that a link is clicked in a confirmation email before a new user has full privileges. Is this a good way to remove spammers/bots, or do you think it would be necessary to incorporate a captcha in the registration form too?

share|improve this question
2  
From a UX point-of-view, CAPTCHA is never required for a good UX. Captcha pushes the burden of spam prevention onto the end user instead of onto the site administrator, which is bad UX. OK, it is often required and if the website is overrun with spammers then that also provides a bad UX, but don't use CAPTCHA unless you really need it. People don't like using it. –  JonW Mar 28 '13 at 10:51
    
Well can spammers get e-mail? :-) Can a script that's smart enough to find your site and fill out its registration form check an e-mail inbox (or a web-based mailbox like guerrillamail.com) and open a link? I would suggest that e-mail verification is insufficient. –  user113215 Mar 28 '13 at 11:39
add comment

6 Answers 6

up vote 11 down vote accepted

CAPTCHA and email verification serve different purposes, so one does not replace the other.

CAPTCHA is a way of trying to make sure that it is a person that is submitting a form and not just a script. There are many alternatives for how you can do this, but that is another question.

Email verification is a way of making sure that the email address that was entered is both correct and authorised to receive communication.

share|improve this answer
add comment

Nobody likes CAPTCHAs, and it is certainly not good UX. E-mail validation will likely not stop the spam bots from getting in, at least it should technically be feasible for them to do so.

You should see this question on a fellow StackExchange site for technical alternatives to using CAPTCHAs, I'm sure your users will thank you: http://security.stackexchange.com/questions/29571/is-there-a-true-alternative-to-using-captcha-images

share|improve this answer
    
Highlights from the link: 1. Lockout account(for a period) after multiple failed tries. 2. Inject random pauses when checking a password. 3. Lock out an IP address with multiple failed logins 4. Design your Web site not to use predictable behavior for failed passwords. –  rk. Mar 28 '13 at 14:05
add comment

More of a security question than a UX question IMO.

UX answer: No, captcha does not add any value to the UX, rather only makes it bad.

IS answer: Unless you have a better (easier to implement, depending on your contraints/skills) alternative like the ones suggested on the security stackexchange question, I think you should go ahead with the captcha code. Unless you are sure your website is under no threat then feel free to just remove the thing :) Another alternative which I have seen in a few websites is asking for simple math questions in an image "55-5" and you just write "50" to pass that verification.

share|improve this answer
add comment

It's hard to deny that filling out a captcha is a pain, you just don't need one unless you are being overruled with spam. The rule of thumb is to use a captcha is a user is suspicious (for example, they are accessing your website through a proxy such as Tor, or if they are using an email provider that is associated with spam (possible Guerrilla Mail))

If you must have a captcha (again, only use it if you need to), I suggest that you separate the captcha from the rest of the form. For example, instead of doing this:

mockup

download bmml source – Wireframes created with Balsamiq Mockups

You can do this:

mockup

download bmml source

This way, instead of the captcha being compulsory, it is optional and the user doesn't have to enter their password again if they can't solve the puzzle on their first try.

share|improve this answer
add comment

Don't do Captchas. Seriously, DON'T. For two reasons: (a) They annoy the becheezes out of people. Any Google search will tell you this. From a personal point of view if a web site uses Captchas then unless they have something that I really, REALLY want, I probably won't deal with them. (b) Second, and as a co-administrator of a phpBB site I can tell you that They. Just. Don't Work. They don't, seriously. Anyone trying to sell you a Captcha system will deny this. In my experience and opinion... they are not telling you the truth. 'Bots can cut through Captchas like a hot knife through butter, it's only humans who have to stare at the accursed things and twist their head 17 different ways before they can work out what that distorted squiggle is supposed to be.

You know what we found stopped them dead in their tracks? Non-obvious (to a computer) questions. For example, "A red car travelled past a green house under a blue sky at 40km/h. What was the colour of the motor vehicle?" Or "I have two pumpkins, a pear, four potatoes and an apple. How many pieces of fruit do I have?"

The down side of this is that it's not great if you expect to have a lot of users whose first language is not English, although our user base does have a global reach and since the site is in English itself, you'd pretty much expect any users to be at least comfortable enough in the language to answer those. The number of spambots that we've had create accounts each day has dropped from a couple of dozen to maybe one per two months, and I'm betting that the one isn't a bot at all but a human in a sub-continental sweatshop. Incidentally, this method also tends to make us a less appealing target for those as well since we have something like 30 questions that can pop up at random and it takes time to look at the question and work out the answer, making us a less appealing target. The time is trivial for a genuine poster, but time is of the essence for spammers.

From a UX perspective, friends don't let friends use Captchas.

share|improve this answer
add comment

The email activation is sufficient to keep spambots from posting on your site. However, they still will pollute your user database. So either you have to clean up your database on a regulary basis, or you need a mechanism to prevent spambots from registering.

For the latter, a visible CAPTCHA requiring user interaction is the least desireable solution. A proven way to lock out bots is to provide for example a 'username' field, which is hidden, but not evaluated, and another field with a merely random name, which is used for the username. So, when 'username' has a value, it is coming from a bot, and the request can be discarded.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.