I have a registration form, name, email, password. I also offer the Facebook connection and in the future all other Open ID ways but for now I would focus on the regular process:

Currently, I require the password confirmation and then I send an email to confirm the email address.

But I really also like the Tumblr way which grants full functionality even without email confirmation, and so with your email+password entered you are into the site in literally 30 seconds...

So my question is: what are the best practices and in terms of metrics/stats if it is better to allow an easy process but with the risk of high volume of fake, wrong, incomplete accounts OR ask more initially so those users who complete the process are "quality users"?

(I hope my question was clear, sorry for my English.)

  • I'd use OpenID with a Facebook or Google account.
    – Felix G
    Sep 15, 2011 at 13:36

4 Answers 4


i'd opt for an instant login (and also a verification email), but with limited privileges until the user confirms the email address.

  • I was going to answer, but this is essentially the same thing I was going to say. Great answer! Oct 27, 2010 at 19:03
  • 2
    @Quamis: Just wondering, since maybe I'm missing something, but why would you limit access based on email verification? All email verification does is allow the user to recover an account. As a measure of if the account is fake, "real", spam, etc. it appears meaningless; reason being that it's very easy to automate email account verification, especially if there's no CAPTCHA in the email verification process; which by the way, I've never seen before. Thanks, and I'm open to any reasons you may have, just would like to understand your logic.
    – blunders
    Oct 27, 2010 at 19:38
  • @blunders - how exactly is it easy to automate receiving the email and clicking on the link inside the email to verify your account? You would have to have every one of those email accounts available to you to receive the emails with the links to click on. And exactly what is your obsession with CAPTCHA? It isn't the be-all, end-all to beating bots. In fact, almost every CAPTCHA out there can and has been beaten if you do some research. Oct 27, 2010 at 20:29
  • @blunders - Oh, and you've never seen an email verification process without CAPTCHA? So what, have you only been using the internet for 5 years or so? CAPTCHA hasn't been widely used for that long. And I still see tons of places that don't use CAPTCHA at all. Oct 27, 2010 at 20:31
  • @charles: captcha actually sucks, i'm pretty sure any decent programmer can fake a real user if he really needs to. I kinda disagree using cahtcha for sensitive data
    – Quamis
    Oct 28, 2010 at 7:55

I personally like StackOverflow's way. Now, I don't know the process SO uses for creating an account w/o OpenID/OpenAuth, but the OpenID/Oauth is easy peezy. Additionally, OpenAuth allows for you to recieve this information, preconfirmed by the OAuth provider, if the user allows (so you'd better sell them on the allow button). Then, as the user contributes (sites define what contribute means) to the site, you gain more privilages.


For starter, Tumblr's site requires more than just any email/password, the email must not be in the database already and you must not have a cookie in your browswer saying you've already created an account; if you've got the cookie, the site automatically logs you in. Guessing that they also limit the number of accounts created per IP per set amount of time; but I'm not able to easly test that since there's a CAPTCHA. Which leads me to the CAPTCHA, after you submit the email/password info, it requires you to pass a CAPTCHA, in this case one by reCAPTCHA; which is now owned by Google.

Before I add additional information/analysis... would you please link to the site in question, so I'm able to get a better idea of the data input and functions provided, or just state them if that works better for you.


  • (1) ISSUE: If a user enters the wrong email by mistake, or on purpose -- and forgets either the password or the bad email for the account, they're locked out, and cannot access there account. RESULT: This would lead to unhappy users, more support contact, etc. SOLUTION: Require email confirmation.


  • 2
    Your "analysis" here (both above and below your big heading) has absolutely nothing to do with the question asked. He's not asking about CAPTCHA or other restrictions that Tumblr might use ("the email must not be in the database already" - um, duh???). He's specifically asking about one process or another. Also, I don't see why you would need to see his specific site to answer this question. Oct 27, 2010 at 19:02

Seems the main question you need to ask is what's contained in the authenticated view once the account is set up with the username and password.

This can take two forms an empty shell or a representation of the person populated with personal information that is already held by the service in question.

Most examples given so far I'd class as shells, in that other than the username and password there is nothing held in the account. In these cases if there's no usage after a period of time it's probably worth purging the account and this would remove misreporting and overheads that might be a result of storing inactive accounts.

If the account provides access to already held information then email verification adds an additional security step against account access. In this case ultimately it will be how risk adverse you organisation is.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.