 <p>The only 'attack' you are addressing through email confirmation, is registering new accounts using random email addresses.</p> <p>IOW, if you leave that step out, an 'attacker' could:</p> <ol> <li>register accounts using just random gibberish addresses</li> <li>register accounts using other people's addresses</li> </ol> <p>Fortunately, in most applications, such an attack isn't very destructive. It may help the attacker forge someone else's identity in a social networking app, or make life <em>slightly</em> easier for a spambot, or it could be used just to annoy the legitimate owner of an email address -- but that's about it.</p> <p>I'd say keep the registration requirement just in case, but scrap the two-step process (let the users create username+password right away).</p>