[anti-abuse-wg] When email verification behavior is abusive

On Wed, 18 Jul 2018 14:32:26 +0100
Richard Clayton <richard at highwayman.com> wrote:
<snip>
> >
> >and so this still begs the question - what is the arbitrary number?  
> in my experience the canonical arbitrary number is 42
> 
so if you receive 41 emails for you to verify your email address from
the same ESP and the same resource, in ten minutes, you would not
consider this abuse or abusive behavior.

good to know, thank you.

> >It seems as if both Richard and Michele agree and do not think that
> >the arbitrary number of 5 verification emails in ten minutes to a
> >victim email address, is abuse or abusive behavior.  
> 
> Michele did not express such an opinion and neither did I.
> 
Of course you did. simply read the paragraph above.
You would not consider 5 emails in ten minutes abuse or are you simply
joking about the "canonical arbitrary number" ? in that case: It is not
very funny as you already seem confused about the TWO abusers.

The criminal going to Google and adding the verification email = Abuse

Google going and sending 5 verification emails in ten minutes = Also Abuse.

> >Still it would be interesting to know if this is actually the case.
> >If nothing under 20 000 "verify your email address" emails per day
> >from the same IP number / resource is not abuse - Then it would be
> >good to know that the members of this abuse WG think that I am silly
> >with my daily limit of three.  
> 
> You appear to have misunderstood the mail bombing attack which is
> widely distributed. The 20000 emails I suggested (as an indicative
> figure, your attack may vary) come from up to 20000 different sources
> -- so very small numbers from each source, thereby avoiding any rate
> limitation systems.
> 
> There is usually just one originating server that automates the
> filling in of forms on the various websites that send the
> verification emails -- though there appear to be multiple criminals
> offering the mail bombing service.
> 
This is a core issue that affects the entire abuse community and the
very definition of what is abuse.

please also do spend the time to look at my thread about the definition
of abuse.

You will note that there are hundreds of posts and even a kind of, sort
of, general consensus of what abuse actually is.

Yes, of course the action of the mail bomber is abuse. 

But, the further action of the ESP is also abuse!

So, it does not matter what criminal, syndicate, person or group
initiates any action...

It is up to the provider of the service, the ESP, to ensure that what
that ESP is doing is not abuse.

Otherwise a criminal can do one action / post - and this results in a
ten fold amplification 

Which brings me back to my Google example: If Google, and ESP, sends
five verify your email address emails in 10 minutes to a victim that is
not known to Google, it will be my contention that this is abusive
behavior.

You do not agree with that?

As you have said that this behavior is not abuse, you have not yet told
me why though?

Andre