10 ms·
It says that an account is automatically created when you push to a url with an email not seen before. Then it goes on to say that there's no security, its not
by gitgud 8y ago
It says that an account is automatically created when you push to a url with an email not seen before. Then it goes on to say that there's no security, its not recommended etc...
Why not make sure the email address has been validated before allowing it to be automatically created?
Because right now someone could spam the sites servers with millions of unverified emails...
- rlonn 8y agoThere are rate limits in place to prevent email spamming. The system stops creating new accounts for a domain where the percentage of unconfirmed accounts is too high. There is also rate limiting on client IP, disallowing client IPs to create lots of unconfirmed accounts. I am also planning to, but haven't got around to it yet, add exponential backoff to email sendouts, so that an increase in the sendout rate causes sendouts to be slower and slower (until manual intervention to increase limits). So, in short: yes, the system could be used for email spamming, but not very effectively. There are better options if all you want to do is spam people.