Abuse Scenario: Email and System Load

[nils-wisiol]

Creating domains under dedyn.io uses a lot of CPU resources and sends an email to the account holder. This can lead to abuse in two ways:

1. Create high system load. A test run creating and deleting a domain 100 times lead to this load just after the 100th delete:

   load average: 4,17, 3,04, 1,81
   

2. Send unwanted emails to any recipient. For dyn=True users, creating a new domain will trigger sending out a welcome email. As we do not require email address ownership to be verified, this can be abused to send an unlimited number of email to any recipient, at a rate just above 1/s.

Proposed steps to resolve this:

1. Verify all email addresses, leave the account in locked state when it's not verified.
2. Limit the total number of domain creations per account via DB counter, in addition to the domain limit.
3. Send the welcome email only once (this needs to be addressed anyways when we remove the dyn flag).

[peterthomassen]

Thoughts:

1.) does not undermine anonymity, as we would not require the user to expose any link to her personal identity (it would be fine to use services like trash-mail.com), and I don't think verifying one's email is an unreasonable hardship for users.

2.) is still prone to bulk account registration and then creating/deleting domains / sending multiple emails until the limit is reached. With email verification, that can still happen, but one can only target oneself.

3.) is similar to 1.), i.e. an attacker can send one email to a random address.

---

I would drop idea 2.) because it still leaves attack surface. Comparing 1.) and 3.), 1.) has the nice side effect to also help avoid having accounts with typos in the email address, so the fraction of account holders that we can actually reach if we need to (downtime announcement, misconfiguration (domain became public suffix?), abuse, ...) increases.

Overall, I'd thus vote for 1.)

[peterthomassen]

covered by the combination of #151/#222 and #160