Re: Preventing account takeovers through expired domains (was: Do we have any policy for disabling inactive users)
On Sat, Feb 19, 2022 at 02:18:38PM +0100, Björn Persson wrote:
Possible step 3: A program on a Fedora Project server notes that
example.net has been deactivated. The program removes the address
j.doe(a)example.net from J. Doe's account, or disables sending to the
nonexistent address.
...
Step 4: The quarantine period ends. The registry releases
example.net
for registration.
This means we would create the domain entering quarantine period
almost like it being deactivated. That's very harsh… Based on a quick
search, it seems that the quarantine varies, but is 14-40 days.
I think it'd be better to check the status weekly and only require
account reconfirmation if the quarantine status is detected ⌊N / 7 - 1⌋
times in a row (where N=quarantine length in days).
Zbyszek