mozilla/browserid — Issue #430: Prevent malicious verification flooding of e-mail addresses of others
Author: aleksejrs
Created: 2011-10-14 19:45:44+00:00
State: open

Currently it is easy to flood someone’s e-mail address with sign up verification e-mails.

Although the victim can easily delete the e-mails, they will probably mark them as spam, or set a filter up, so that when they try to register a BrowserID account themselves, they won’t get the verification e-mail.

One way could be creating a mandatory delay between sending verification e-mails, e.g. a 15-second delay after the first one (in case the e-mail message is lost), more after the second one, and even more for each subsequent one.

That is unless:
* an actual verification happens;
* the address is known to have been used with this identity provider (recently/often? Note also the possible abuse of + suffixes).

In case the address owner trusts the provider with his address, but doesn't need an ID account, there might also be a way for him to choose a delay himself (but not too long a delay, and real spam often contains "unsubscribe" links and is intended to verify e-mail addresses).