Most websites that do email confirmation for new users send users a hash link to click on to activate their account, and the user gets to pick their own password either after clicking the hash link, or before. Drupal sends users an email with an impossible-to-remember randomly generated password, and requires them to copy and paste that into the login screen in their browser. This creates three problems:

1) It's only easy for people who are comfortable with cut and paste and with switching applications (my parents are among the millions of people who are not).
2) It's different from what nearly every other CMS or mailing list management system does. That in itself is enough to make it confusing and inaccessible.
3) Even if you finally do cut & paste your way in, if you don't instantly go to the trouble of changing your password, it remains an impossible-to-remember string of random characters. Good luck logging in next time, when your cookie expires.

Any political organization, for example, which is using Drupal to build a large database of non-tech-savvy users, is currently getting--I would hazard a guess-- 20-50% less sign ups because confirmation is currently a pain in the ass. That translates into less support, less money, less votes, etc. Why put unecessary barriers in peoples' way when they want to join your site?

I've heard this state of affairs justified before as a reverse Turing test or CAPTCHA. But it just doesn't make sense to weave those two pieces of functionality into one step; you're just widening the hurdle that regular human users need to leap over. And lots of Drupal admins who don't have a problem with bots won't even need bot-blocking technology.

A proposed solution:

In the initial signup, ask users to choose their password. For confirmation, send users a hash link that confirms their email address and logs them in. Make an optional captcha feature that admins can turn on if they want, and make users "solve" the captcha question after they click on the hash link.

Comments

kps’s picture

kps commented

A similar problem I've run into is that users copy the blank before, or the newline after, the password, and therefore can't log in. A suitable trim() fixes this....

laird’s picture

laird commented

I'd like to second this. I'm at a company that's considering Drupal for a large scale deployment, and this one issue is a "blocker" for us. Our target users are non-technical, and making them copy/paste the password is painful to them.

The ideal flow would be:
- User registers, entering a username, email address and password.
- User reads email, and clicks on email confirmation link.
- Registration is completed (in the database), and the user lands on a 'welcome to $site' page.

pamphile’s picture

pamphile commented

I'm creating a Verified Member-only hack that does this:

The ideal flow would be:
- User registers, entering a username, email address and password.
- User is sent a email saying "We got your message"
- Admin validates user
- User is automaticall sent a Acceptance or Rejection email

It's not a module, just a hack with an additional table.

I'll post a link to it when it's finished.

pamphile’s picture

pamphile commented

related node: http://drupal.org/node/14613

bs’s picture

bs commented
Priority: Normal » Critical

I too agree that user registration module needs a little bit of hack. We also need random number image verification code to protect from Spam with accessibility option. I hope drupal team will look in to this matter.

chx’s picture

chx commented
Priority: Critical » Normal
Status: Active » Closed (won't fix)

The user confirmation process has changed much in Drupal 4.7

Also, captcha over my dead body.

kbahey’s picture

kbahey commented
Status: Closed (won't fix) » Active

Captcha has issues with accessibility, so that part is up to debate. Let us ignore that for the time being.

However, the original request was for getting two emails, one at the time of registration saying that the admin will approve, and another at the time of approval/decline informing the user.

Here is what happens with the current HEAD (synced today):

- I set admin/settings/user to : "Visitors can create accounts but administrator approval is required."

- I sign up as a user, and this message comes up: "Your password and further instructions have been sent to your e-mail address."

- I get an email with a password that gives me access to the site.

So, HEAD is not doing what we want it to do, and this issue should remain open until it is resolved.

bdragon’s picture

bdragon commented
Version: x.y.z » 6.x-dev
Status: Active » Closed (won't fix)

There's a nice "one time login" link nowadays in core. Also, logintoboggan with its many options. Also, the message has been clarified since.

jabevan’s picture

jabevan commented

Question about this. I have not implemented it yet, but have 5% of users who are giving fake email addresses or email addresses that aren't working. I debating whether to implement email confirmation or just let it go.

***Does anyone have specific stats on how much email confirmation reduces sign ups??***

vojnar’s picture

vojnar commented

Check this link:

http://drupal.org/project/localemail

jhansi’s picture

jhansi commented
Title: Simplify new user confirmation email » New user confirmation email

Hi,
I have created Customer Number ,Instead of random password number in new user confirmation mail(changed password to seaquence customer number).every thing works fine.I can see that customer number in confirmation mail.

My problem is ,i want that customer number should be displayed,only after clicking the confirmation link from there mail.

Need help.

Jhansi.

scott m. sanders’s picture

scott m. sanders commented

For sake of feedback, my client had me replace the first line of the admin-approval email with this instead:

"Thank you for registering at !site. The username and password listed below will allow you to access the distributor-only section once you have received a second email confirming your account has been setup:"

We found that his customer was clicking the login link before an admin was giving approval and thus being denied access.

Also this customer is elderly and admittedly does not know how to cut-and-paste the emailed password, much less enter it case-sensitive, though this module helps: http://drupal.org/project/nocase

1kenthomas’s picture

1kenthomas commented
Title: New user confirmation email » Simplify new user confirmation email

#@($&(&. Don't change the subject of an issue that's been closed for 3 years, during your second week with a d.o. account.