4 ms·

So Reddit doesn't require email confirmation, just a username and password. PG definitely prefers that style, as I've read. I bet other YC sites do the same thi

by sabat 20y ago

So Reddit doesn't require email confirmation, just a username and password. PG definitely prefers that style, as I've read. I bet other YC sites do the same thing. Aren't you asking for trouble, though? Isn't that too easy to abuse, especially for a social-voting site liked Reddit? Help me understand why these sites are not worried.

staunch 20y ago
The thing that protects you the best is obscurity. If you have hordes of determined bad guys targeting your site it's probably not so bad -- it means your site is very popular (or stores credit card numbers). Generally, IP addresses are a much more limited resource than email addresses. Although open proxies and botnets make them less so. Reddit probably fights off abuse primarily based on individual IPs and entire address blocks. IP geo-location can help a lot in certain cases too. CAPTCHAs really do the most to slow down the worst kinds of abuse.
- phil 20y ago
  I agree. Obscurity is fine in this case, because if abuse becomes a problem, it will be new accounts that are the problem. So you can just add confirmation, captcha, etc. on the fly when the time comes.
bls 20y ago
Email confirmation isn't a CAPTCHA: If you can write a robot to sign up for reddit.com, then surely you can write a robot to send a "HTTP GET" request for every link in your email account. There are three obvious purposes for email confirmation: - Users often forget their usernames/passwords. Usually the only way to remind them is by sending them email. If they used an invalid email address (purposely or accidently), you will end up with support emails saying "I forgot my username and password but I don't have any evidence that it is actually my account!" Email confirmation ensures that you can communicate with the user on a side channel. - When raising money / selling advertising, how many users' email addresses you know is a big deal. People use this metric to judge how "engaged" the user in the site. - It makes it difficult to have multiple accounts. Again, advertisers/investors look at the number of unique users when deciding to fork over money. If the user will be storing any important information/money solely using your service, you should go through the confirmation process ASAP so that they don't get locked out of their data/money. If your site is a "waste your time and hopefully click on my ads" service, then: (1) Have a page where the user enters his proposed username/password, with no email field. This makes it look really simple to sign up. (2) When the user submits #1, bring up a page with the email address field. This page should already show the user as being logged in & show/hint that the user has already unlocked whatever functionality requires an account. The big print on the page explains why you are asking for it and your amazing privacy policy. The fine print tells the user that it is optional but highly recommended, and remind about your amazing privacy policy. (3) If/When the user submits their email address, send the user an email. But, unlock the account functionality without requiring confirmation. (4) In the email, provide a brief explanation of confirmation and provide the confirmation link. Automatic password reminders can only be done after this initial confirmation link has been requested.
Laurentvw 20y ago
I just don't like the confirmation email. It's such a hassle. You could still add an email field when signing up, but only for the sole purpose of giving the user a chance to get his/her password back in case he/she forgot it.
sabat 20y ago
Great replies. On the subject of CAPTCHAs: I'm seeing a lot of variations of this lately, like "what is 2+3?" in a graphic, or "click on all the ducks" next to 6 photos with 2 ducks. You get the picture. I think CAPTCHA is on the way out. If we have to prove you're human, there are better ways than "try to interpret this blurry, distorted graphic and type it here". Opinions?
- timg 20y ago
  examples?
  - whacked_new 20y ago
    there are a couple ways of thinking about this, but i certainly don't think captchas are on the way out. (well, one way out is something like OpenID) since captchas are based on feature detection in domains where humans are still far superior to computers, the ultimate captcha would be something based on faces. the problem is the permutability of the variables in the captcha means a lot more overhead for more variables graphically produced. i mean, to produce a string of text is far easier than to produce 10 faces. and in picture captchas are you left with pass/fail for every picture, so it leads to much less permutability, compared to text. in this regard, i think text-based captchas still have a place and will stay for quite a while. and the newer "what is 2 + 3" is so bafflingly breakable that i can't believe it is actually being used. a method i think worth exploring is by tracking mouse clicks, like show a banner-sized picture and ask users to click through items in a certain sequence, like "mouse, truck, building, blah blah." then you calculate the deviation from the hit-zone. however this cannot be done without a mouse. to make it keyboard-friendly you'd probably need to present a bunch of icons and ask users to select those icons in some order. in fact, i imagine this to be a good password replacement scheme (but again, as a password scheme you'd need 26x2 + 10 icons to match the permutability of a d+w password. hence the mouseclick) but in any case, captchas are fairly distracting when they appear, so the captcha idea i wrote above is something i would do only when i have enough time to play with.
    - bls 20y ago

by sabat 20y ago

staunch 20y ago

The thing that protects you the best is obscurity. If you have hordes of determined bad guys targeting your site it's probably not so bad -- it means your site is very popular (or stores credit card numbers). Generally, IP addresses are a much more limited resource than email addresses. Although open proxies and botnets make them less so. Reddit probably fights off abuse primarily based on individual IPs and entire address blocks. IP geo-location can help a lot in certain cases too. CAPTCHAs really do the most to slow down the worst kinds of abuse.

phil 20y ago
I agree. Obscurity is fine in this case, because if abuse becomes a problem, it will be new accounts that are the problem. So you can just add confirmation, captcha, etc. on the fly when the time comes.

bls 20y ago

Email confirmation isn't a CAPTCHA: If you can write a robot to sign up for reddit.com, then surely you can write a robot to send a "HTTP GET" request for every link in your email account. There are three obvious purposes for email confirmation: - Users often forget their usernames/passwords. Usually the only way to remind them is by sending them email. If they used an invalid email address (purposely or accidently), you will end up with support emails saying "I forgot my username and password but I don't have any evidence that it is actually my account!" Email confirmation ensures that you can communicate with the user on a side channel. - When raising money / selling advertising, how many users' email addresses you know is a big deal. People use this metric to judge how "engaged" the user in the site. - It makes it difficult to have multiple accounts. Again, advertisers/investors look at the number of unique users when deciding to fork over money. If the user will be storing any important information/money solely using your service, you should go through the confirmation process ASAP so that they don't get locked out of their data/money. If your site is a "waste your time and hopefully click on my ads" service, then: (1) Have a page where the user enters his proposed username/password, with no email field. This makes it look really simple to sign up. (2) When the user submits #1, bring up a page with the email address field. This page should already show the user as being logged in & show/hint that the user has already unlocked whatever functionality requires an account. The big print on the page explains why you are asking for it and your amazing privacy policy. The fine print tells the user that it is optional but highly recommended, and remind about your amazing privacy policy. (3) If/When the user submits their email address, send the user an email. But, unlock the account functionality without requiring confirmation. (4) In the email, provide a brief explanation of confirmation and provide the confirmation link. Automatic password reminders can only be done after this initial confirmation link has been requested.

Laurentvw 20y ago

I just don't like the confirmation email. It's such a hassle. You could still add an email field when signing up, but only for the sole purpose of giving the user a chance to get his/her password back in case he/she forgot it.

sabat 20y ago

Great replies. On the subject of CAPTCHAs: I'm seeing a lot of variations of this lately, like "what is 2+3?" in a graphic, or "click on all the ducks" next to 6 photos with 2 ducks. You get the picture. I think CAPTCHA is on the way out. If we have to prove you're human, there are better ways than "try to interpret this blurry, distorted graphic and type it here". Opinions?

timg 20y ago
examples?
- whacked_new 20y ago
  there are a couple ways of thinking about this, but i certainly don't think captchas are on the way out. (well, one way out is something like OpenID) since captchas are based on feature detection in domains where humans are still far superior to computers, the ultimate captcha would be something based on faces. the problem is the permutability of the variables in the captcha means a lot more overhead for more variables graphically produced. i mean, to produce a string of text is far easier than to produce 10 faces. and in picture captchas are you left with pass/fail for every picture, so it leads to much less permutability, compared to text. in this regard, i think text-based captchas still have a place and will stay for quite a while. and the newer "what is 2 + 3" is so bafflingly breakable that i can't believe it is actually being used. a method i think worth exploring is by tracking mouse clicks, like show a banner-sized picture and ask users to click through items in a certain sequence, like "mouse, truck, building, blah blah." then you calculate the deviation from the hit-zone. however this cannot be done without a mouse. to make it keyboard-friendly you'd probably need to present a bunch of icons and ask users to select those icons in some order. in fact, i imagine this to be a good password replacement scheme (but again, as a password scheme you'd need 26x2 + 10 icons to match the permutability of a d+w password. hence the mouseclick) but in any case, captchas are fairly distracting when they appear, so the captcha idea i wrote above is something i would do only when i have enough time to play with.
  - bls 20y ago