3 ms·

I had to add a captcha to a registration page a couple years ago. Bots were signing up for thousands of fake accounts with other people’s email addresses. The e

I had to add a captcha to a registration page a couple years ago. Bots were signing up for thousands of fake accounts with other people’s email addresses. The email confirmation we sent would then get reported as spam since the recipient didn’t sign up for our service. Our email provider suspended our account for high spam reports.

Spivak 2y ago
I hope the other lesson was the good email verification hygiene of making the user take an affirmative action and click a "verify email" button rather then send it unsolicited. You essentially had an open public unauthed form that would send an email to any address you typed in it. Surely that alone raises some eyebrows.
- toast0 2y ago
  How do you authenticate a verify email button?
  - klez 2y ago
    It took me a while to understand what GP was trying to say, but I suppose they're thinking of one of those sites where they let you create an account, will let you in and then nag you for a while about "verifying your email address" by clicking a link that will actually send you an email. An unsophisticated spambot won't probably care enough to click through that.
- binarycoffee 2y ago
  Not a solution. Verification emails alone got a small web site I set up to be blacklisted within days. Most of the unwilling recipients presumably couldn't understand the language the verification email was written in and reported it as spam.
- stanmancan 2y ago
  How would adding an extra button change anything? Right now when they register we send a “verify email address” email. Adding an extra step of “click a button” makes no meaningful difference.
reginald78 2y ago
What's is the play by the spammers here? Is it a direct attack on your website, perhaps because they were competitors? Or are they hoping that 1% of spammed email addresses will accidentally verify their email?
- stanmancan 2y ago
  No clue to be honest; I just added a captcha and moved on with life. It’s a small side project so it wasn’t worth investing.

Spivak 2y ago

I hope the other lesson was the good email verification hygiene of making the user take an affirmative action and click a "verify email" button rather then send it unsolicited. You essentially had an open public unauthed form that would send an email to any address you typed in it. Surely that alone raises some eyebrows.

toast0 2y ago
How do you authenticate a verify email button?
- klez 2y ago
  It took me a while to understand what GP was trying to say, but I suppose they're thinking of one of those sites where they let you create an account, will let you in and then nag you for a while about "verifying your email address" by clicking a link that will actually send you an email. An unsophisticated spambot won't probably care enough to click through that.
binarycoffee 2y ago
Not a solution. Verification emails alone got a small web site I set up to be blacklisted within days. Most of the unwilling recipients presumably couldn't understand the language the verification email was written in and reported it as spam.
stanmancan 2y ago
How would adding an extra button change anything? Right now when they register we send a “verify email address” email. Adding an extra step of “click a button” makes no meaningful difference.

reginald78 2y ago

What's is the play by the spammers here? Is it a direct attack on your website, perhaps because they were competitors? Or are they hoping that 1% of spammed email addresses will accidentally verify their email?

stanmancan 2y ago
No clue to be honest; I just added a captcha and moved on with life. It’s a small side project so it wasn’t worth investing.