Multi-factor authentication doesn’t stop a bot and isn’t meant to.
Email verification is even less likely to stop a bot and isn’t meant to.
For captchas, the old captchas like writing the text of an image are now next to useless. Google’s newer Recaptcha isn’t perfect, if 1% of a bot’s attempts get through and it tries to create a million accounts, that’s still 10,000 accounts. Not to mention, if the captcha is used only rarely, then a team of humans can be called upon to solve the captchas when they show up.
Latest Answers