
Website Signup w/o Confirmation: Any Problems with That? - sabat

======
sabat
So Reddit doesn't require email confirmation, just a username and password. PG
definitely prefers that style, as I've read. I bet other YC sites do the same
thing.

Aren't you asking for trouble, though? Isn't that too easy to abuse,
especially for a social-voting site liked Reddit? Help me understand why these
sites are not worried.

~~~
staunch
The thing that protects you the best is obscurity. If you have hordes of
determined bad guys targeting your site it's probably not so bad -- it means
your site is very popular (or stores credit card numbers).

Generally, IP addresses are a much more limited resource than email addresses.
Although open proxies and botnets make them less so. Reddit probably fights
off abuse primarily based on individual IPs and entire address blocks. IP geo-
location can help a lot in certain cases too.

CAPTCHAs really do the most to slow down the worst kinds of abuse.

~~~
phil
I agree. Obscurity is fine in this case, because if abuse becomes a problem,
it will be new accounts that are the problem. So you can just add
confirmation, captcha, etc. on the fly when the time comes.

