I was just wondering if requiring email verification for accounts would help safeguard phuks a bit from those that will see its existence as a problem?
If that's a stupid idea or wouldn't work, let me know. As I have very little knowledge with how the technicalities of it all.
Advanced bots CAN shrug off email validation (they could manage their own email addresses and just follow the links), it's no better than a regular captcha
The only easy and effective way is putting rate limits and captchas everywhere.
We currently have a captcha on registration, but that wouldn't stop someone from manually registering 500 accounts and then script them to spam the whole site though.
I figured that most users (myself included) generally use junk email accounts to avoid divulging PII. Maybe even tell them to make a junk account as you cannot or will not safeguard emails, that way it wouldn't mean extra costs for maintaining and securing their info beyond conventional means.
Thanks for the welcome, this place looks awesome!