What percentage of users activate their accounts?
To those of you that work on websites that require users to click a link in an e-mail to validate their accounts: what percentage of users complete the activation process?
8 comments
total accounts: 45800
confirmed emails: 28800
total unique people as determined by cookies/ip addresses: 28900
System lets people use the site for 10 minutes after they sign in before they are forced to confirm their email if they have not done so already.
confirmed emails: 28800
total unique people as determined by cookies/ip addresses: 28900
System lets people use the site for 10 minutes after they sign in before they are forced to confirm their email if they have not done so already.
We don't do that. It just another barrier to entry. Hopefully you do it because it's necessary for the product and not because you want to have a validated e-mail.
Not doing it can lead to email hijacking:
Consider someone signing up with my email address: [email protected]. Now I'm not going to be able to use that email address, because it is already taken. Worse, if messages to that account, such as invitations, the attacker can accept them, since they typically see the invitations on the site in addition to it being sent to the email address.
As the legit user, I might see the invites, but won't be able to log in at all. Worse things can happen: once the attacker signs up, they could make this email address secondary and add another, primary address so that they see all of the messages.
Consider someone signing up with my email address: [email protected]. Now I'm not going to be able to use that email address, because it is already taken. Worse, if messages to that account, such as invitations, the attacker can accept them, since they typically see the invitations on the site in addition to it being sent to the email address.
As the legit user, I might see the invites, but won't be able to log in at all. Worse things can happen: once the attacker signs up, they could make this email address secondary and add another, primary address so that they see all of the messages.
I disagree. Don't you need to validate their email address so you know you're reaching only people who wanted to sign up?
Well, you could do an opt-out service -- send an e-mail that says "click here if this isn't you"
Or use something a simple screenname for authentication (e.g. the e-mail is just for lost passwords, so if they don't provide a valid e-mail, it's their loss).
Or use something like OpenID or Passport (the identity provider might need to validate an e-mail address but you don't have to).
Or build a site that needs no authentication to begin with -- e.g. a search engine.
Or use something a simple screenname for authentication (e.g. the e-mail is just for lost passwords, so if they don't provide a valid e-mail, it's their loss).
Or use something like OpenID or Passport (the identity provider might need to validate an e-mail address but you don't have to).
Or build a site that needs no authentication to begin with -- e.g. a search engine.
I don't have an answer (since my site isn't active yet) but I have another question: what percentage of users that don't validate their accounts actually entered their personal email address?
well, as a user, i activate pretty much 100% of my accounts, even if i dont really use them afterwards.
this is probably because all of those sites require me to activate in order to use their service.
hope this helps.
this is probably because all of those sites require me to activate in order to use their service.
hope this helps.
averaging 85%. seems low.