Samir Al-Battran

@fediforum glad to have you onboard!
And very excited to see all the lovely people next week

@jaz @gunchleoc I agree 💯 but moving the registration to the insurance instead of API doesn't mean the app is locked out of the process. You just kick the user to the browser or use a webview in the app but the instance is in full control of registration (not the app)
Yes the UI will be different but most users won't even realize what's happening under the hood

@joshix @MastodonEngineering I guess it would also stop people registering lol

So these bots have valid Gmail accounts?

@gunchleoc
Regarding email spam, you can throttle email confirmation down to make it useless for them.

Also #3 goes hand in hand with #2 to prevent using own mail server

@jaz @gunchleoc
To be honest Jaz, I don't understand why apps are allowed to register users
It's not a lot of friction to ask users to register directly on the instance then connect the app
I am sure the bp spam will try the instance directly but at least you can have more control on the instance

@MastodonEngineering
Here are some ideas:
1. Account creation should only be done by the instance not apps
2. Accounts cannot be created without confirming email first
3. Emails that are not on popular services (e.g. gmail, hotmail, yahoo etc) should prompt a difficult captcha to solve even before verification is sent