4 ms·
For all of you folks who say that confirmation emails are a bad idea, let's talk about a service in which the user can download large files once they are "confi
by ScottWhigham 16y ago
For all of you folks who say that confirmation emails are a bad idea, let's talk about a service in which the user can download large files once they are "confirmed". I'm thinking of a site like http://www.shutterstock.com/ http://www.shutterstock.com/. They offer two free downloads per week and those files can be up to 30MB each.
Let's say that Shutterstock wanted to expand - they want to allow new users to download ANY two images they wanted for free.
Would you advise them to go with a confirmation-less email routine? If so, how do you prevent bots from creating bogus signups and then (a) stealing your images at will, (b) so that they can resell/rehost them in Russia/China and make money/compete with you, and (c) clogging up all of your bandwidth?
For example, the bot signs up with 00001@gmail.com then downloads 60MB files while another bot uses 0002@gmail.com then downloading 60MB in files, etc.
And please - no solutions that require manual intervention or cannot scale.
- threedaymonk 16y agoConfirmation won't help here. In your hypothetical example, I set up a mail server at bulkdownloadrobot.biz and get my bot to use 00001@, 00002@ etc. The bot follows the confirmation links before downloading 60MB for each account. Now, you might detect that bulkdownloadrobot.biz is a bad domain and blacklist it, but all I have to do is to register a new domain each time that happens. So now you implement a heuristic that detects patterns of signups from domains. Now, I start buying Gmail accounts created by workers in a CAPTCHA-solving sweatshop. You've increased my costs slightly, but you haven't solved the problem.