[anti-abuse-wg] When email verification behavior is abusive

In message , ac <ac at main.me> writes

>lets use a real world and existing example:
>
>Me/I (Andre) goes and adds richard at highwayman.com as my 'recovery' email on 
>Google.
>
>Google then goes and dumps 5 verification emails on richard at highwayman.com in 
>say 10 minutes
>(as they indeed sometimes do...)

I expect they actually send 1 email to each of 5 different accounts
which you collect into a single mailbox... in similar circumstances I
have never seen more than one email.

>Would you, Richard, consider Google's behavior as Abuse? 

no, it's clearly your fault for adding my email -- if you did it
deliberately then that's abuse, if you typo-ed my email address then
that's just one of those accidents that happened in the real world

note that in such circumstances you could well have allowed me to take
over your account ... which naturally I would not take advantage of

>If you just received one email (or maybe two?) - Where is the arbitrary
>number where you personally would consider a verification email, as
>abusive behavior? Or is five okay? is ten okay? 

if you receive more than one email per recovery account then something
is broken at Google -- making a fault report is far more useful than
deeming Google to be abusive (which will not make anything change)

-- 
Dr Richard Clayton                               <richard.clayton at cl.cam.ac.uk>
Director, Cambridge Cybercrime Centre                mobile: +44 (0)7887 794090
Computer Laboratory, University of Cambridge, CB3 0FD   tel: +44 (0)1223 763570
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 185 bytes
Desc: not available
URL: </ripe/mail/archives/anti-abuse-wg/attachments/20180718/5acf5cdb/attachment.sig>