Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I was playing around with Amazon's Check out process today and I noticed something odd. Amazon does not make you activate your account or verify your email address. I only had to enter my email twice during the registration process. They never sent me an activation email. Is this becoming standard? I can understand the reasoning that if you entered someone else's email address during registration the person who actually owns the email address could change the password on the account. It just seems really odd. Can someone explain how they get away with this?

share|improve this question

migrated from stackoverflow.com Dec 19 '10 at 3:51

This question came from our site for professional and enthusiast programmers.

2 Answers 2

What do you mean how do they get away with that?

The just don't do it... There's no getting away with anything, as there's nothing that says they have to.

They don't save any information other than email, name, and wish list, so there really isn't that much that someone could get away with if the email address wasn't the registrants...

share|improve this answer
    
A person could fill their drives with garbage. Or eat up their processor cycles; it takes more effort to save something to a database and satisfy constraints than it does to spam a site with random text. Granted, any good firewall or banning system should cut that kind of DoS off at the knees even for an enormous botnet, but still. Of course, for an enormous botnet, there are bigger problems. –  Parthian Shot Jul 29 at 16:36

Email activation doesn't stop automated registration and it's generally a nuisance for the user.

Amazon is in the business of making it as easy as possible for you to register and drill down through their checkout structure so you pay them. An email activation system is just a speed bump with no worthwhile purpose. What does Amazon care if you didn't provide a real email address if you gave real credit card information?

On the other hand, a message board website might want you to verify your email to inconvenience the average spammer. But even then, check out utilities like http://10minutemail.com/10MinuteMail/index.html that makes "bogus" email verification effortless.

share|improve this answer
2  
You make some good points, but no anti-spam/bot system is perfect. The idea is just to make it difficult enough that spammers will move on to easier targets. For smaller sites, email verification may be just enough to do that. And most legitimate users are happy to verify their email address. I mean, what do you think will turn off users more? Having to verify your email once on sign-up, or having to wade through spam messages every time you visit the site? –  Lèse majesté Dec 19 '10 at 13:15
    
Email activation doesn't stop automated registration It's called defense in depth, and it's been a part of security systems since long before humans had words for either "security" or "systems". Actually, strictly speaking, it's been around since before there were humans. You're a bit behind the times on that. Most attackers go for low-hanging fruit. Remove the small trees, most of your problems are solved. Unless you're being attacked by a giraffe. –  Parthian Shot Jul 29 at 16:28
    
In other words, if you take only one thing from my comment above, let it be that spammers are giraffes, and your website is a hedgehog. –  Parthian Shot Jul 29 at 16:31

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.