Is a captcha necessary when email validation is being utilised?

Question

During registration for my new website, I'm going to require that a link is clicked in a confirmation email before a new user has full privileges. Is this a good way to remove spammers/bots, or do you think it would be necessary to incorporate a captcha in the registration form too?

Answer 1

CAPTCHA and email verification serve different purposes, so one does not replace the other.

CAPTCHA is a way of trying to make sure that it is a person that is submitting a form and not just a script. There are many alternatives for how you can do this, but that is another question.

Email verification is a way of making sure that the email address that was entered is both correct and authorised to receive communication.

Answer 2

Don't do Captchas. Seriously, DON'T. For two reasons: (a) They annoy the becheezes out of people. Any Google search will tell you this. From a personal point of view if a web site uses Captchas then unless they have something that I really, REALLY want, I probably won't deal with them. (b) Second, and as a co-administrator of a phpBB site I can tell you that They. Just. Don't Work. They don't, seriously. Anyone trying to sell you a Captcha system will deny this. In my experience and opinion... they are not telling you the truth. 'Bots can cut through Captchas like a hot knife through butter, it's only humans who have to stare at the accursed things and twist their head 17 different ways before they can work out what that distorted squiggle is supposed to be.

You know what we found stopped them dead in their tracks? Non-obvious (to a computer) questions. For example, "A red car travelled past a green house under a blue sky at 40km/h. What was the colour of the motor vehicle?" Or "I have two pumpkins, a pear, four potatoes and an apple. How many pieces of fruit do I have?"

The down side of this is that it's not great if you expect to have a lot of users whose first language is not English, although our user base does have a global reach and since the site is in English itself, you'd pretty much expect any users to be at least comfortable enough in the language to answer those. The number of spambots that we've had create accounts each day has dropped from a couple of dozen to maybe one per two months, and I'm betting that the one isn't a bot at all but a human in a sub-continental sweatshop. Incidentally, this method also tends to make us a less appealing target for those as well since we have something like 30 questions that can pop up at random and it takes time to look at the question and work out the answer, making us a less appealing target. The time is trivial for a genuine poster, but time is of the essence for spammers.

From a UX perspective, friends don't let friends use Captchas.

Answer 3

Nobody likes CAPTCHAs, and it is certainly not good UX. E-mail validation will likely not stop the spam bots from getting in, at least it should technically be feasible for them to do so.

You should see this question on a fellow StackExchange site for technical alternatives to using CAPTCHAs, I'm sure your users will thank you: https://security.stackexchange.com/questions/29571/is-there-a-true-alternative-to-using-captcha-images

Answer 4

More of a security question than a UX question IMO.

UX answer: No, captcha does not add any value to the UX, rather only makes it bad.

IS answer: Unless you have a better (easier to implement, depending on your contraints/skills) alternative like the ones suggested on the security stackexchange question, I think you should go ahead with the captcha code. Unless you are sure your website is under no threat then feel free to just remove the thing :) Another alternative which I have seen in a few websites is asking for simple math questions in an image "55-5" and you just write "50" to pass that verification.

Answer 5

It's hard to deny that filling out a captcha is a pain, you just don't need one unless you are being overruled with spam. The rule of thumb is to use a captcha is a user is suspicious (for example, they are accessing your website through a proxy such as Tor, or if they are using an email provider that is associated with spam (possible Guerrilla Mail))

If you must have a captcha (again, only use it if you need to), I suggest that you separate the captcha from the rest of the form. For example, instead of doing this:

^{download bmml source – Wireframes created with Balsamiq Mockups}

You can do this:

^{download bmml source}

This way, instead of the captcha being compulsory, it is optional and the user doesn't have to enter their password again if they can't solve the puzzle on their first try.

Answer 6

The email activation is sufficient to keep spambots from posting on your site. However, they still will pollute your user database. So either you have to clean up your database on a regulary basis, or you need a mechanism to prevent spambots from registering.

For the latter, a visible CAPTCHA requiring user interaction is the least desireable solution. A proven way to lock out bots is to provide for example a 'username' field, which is hidden, but not evaluated, and another field with a merely random name, which is used for the username. So, when 'username' has a value, it is coming from a bot, and the request can be discarded.

Answer 7

What are your views on instant verification i.e. send the email and expect on screen response with the code sent in the email? Still a high chance that bots are prepared for it and will get past it quickly?

This is not a UX question, more of a spam question? Any additional actions required by a user to get through a process will always be bad UX which I understand