Why do new users need to click an extra button to Activate their account?

It is an anti spam / auto account creation protection.

If you can activate by just retrieving the link, auto creation of accounts becomes trivial at the command line. Send 500 email activations, loop through them with curl, bam, you have 500 new accounts to spam with.

(Reminder, most spammers are 100% human these days so captcha does nothing. Say hello to our leetle friend bamwar for example, huge problems with these insanely persistent humans on many Discourse sites)

Also the premise of the question is a bit weird, clicking one button in the browser is “too long”?

7 Likes