{"issue":{"pull_request":{"diff_url":null,"html_url":null,"patch_url":null},"state":"closed","user":{"avatar_url":"https://secure.gravatar.com/avatar/3e4a54069e6731e9e47ea26aa2368aba?d=https://a248.e.akamai.net/assets.github.com%2Fimages%2Fgravatars%2Fgravatar-140.png","gravatar_id":"3e4a54069e6731e9e47ea26aa2368aba","url":"https://api.github.com/users/aleksejrs","login":"aleksejrs","id":1025861},"milestone":null,"assignee":{"avatar_url":"https://secure.gravatar.com/avatar/b7581393f6d1960ea7721789cbbe5c36?d=https://a248.e.akamai.net/assets.github.com%2Fimages%2Fgravatars%2Fgravatar-140.png","gravatar_id":"b7581393f6d1960ea7721789cbbe5c36","url":"https://api.github.com/users/shane-tomlinson","login":"shane-tomlinson","id":848085},"labels":[{"name":"★★★★","color":"337910","url":"https://api.github.com/repos/mozilla/browserid/labels/%E2%98%85%E2%98%85%E2%98%85%E2%98%85"}],"updated_at":"2011-11-01T16:36:07Z","comments":6,"closed_at":"2011-10-31T12:39:07Z","url":"https://api.github.com/repos/mozilla/browserid/issues/430","body":"Currently it is easy to flood someone’s e-mail address with sign up verification e-mails.\r\n\r\nAlthough the victim can easily delete the e-mails, they will probably mark them as spam, or set a filter up, so that when they try to register a BrowserID account themselves, they won’t get the verification e-mail.\r\n\r\nOne way could be creating a mandatory delay between sending verification e-mails, e.g. a 15-second delay after the first one (in case the e-mail message is lost), more after the second one, and even more for each subsequent one.\r\n\r\nThat is unless:\r\n* an actual verification happens;\r\n* the address is known to have been used with this identity provider (recently/often? Note also the possible abuse of + suffixes).\r\n\r\n\r\nIn case the address owner trusts the provider with his address, but doesn't need an ID account, there might also be a way for him to choose a delay himself (but not too long a delay, and real spam often contains \"unsubscribe\" links and is intended to verify e-mail addresses).","html_url":"https://github.com/mozilla/browserid/issues/430","number":430,"title":"Prevent malicious verification flooding of e-mail addresses of others","id":1913524,"created_at":"2011-10-14T19:45:44Z"},"action":"created","comment":{"user":{"avatar_url":"https://secure.gravatar.com/avatar/5810c72f30b0ab202823d8c26460c39d?d=https://a248.e.akamai.net/assets.github.com%2Fimages%2Fgravatars%2Fgravatar-140.png","gravatar_id":"5810c72f30b0ab202823d8c26460c39d","url":"https://api.github.com/users/lloyd","login":"lloyd","id":39411},"updated_at":"2011-11-01T16:36:07Z","url":"https://api.github.com/repos/mozilla/browserid/issues/comments/2592551","body":"@shane-tomlinson beautiful!  nice doing business with you.\r\n","id":2592551,"created_at":"2011-11-01T16:36:07Z"}}