gangleri wrote:

Dear friends, e-mails returned with failure because of the header
item "Return-path: <wiki@wikimedia.org>" should be processed in
the "system" too. This should disable the "email tis user" function
and prompt to these users during login to go trough the e-mail
verification again. If a feedback could be given to the sender it
would be great.
Regards Reinhardt

I think, the blocker can be justified after a recent discussion with Brion about
a certain scenario with temp.passwords mailed to not-yet-authenticated address.

Disclaimer, because I am not fully sure, if the scenario can be exploited to
hijack an account:
In case that I was over-reacting, pls. apologize and silently remove the blocker.

rowan.collins wrote:

I don't see any way you could hijack an account using the temp password
mechanism - you'd have to already have control of the account to set the
password, authenticated or not. But I wasn't party to this discussion, so I
won't touch anything here.

robchur wrote:

We already have this functionality; it's a configuration issue.

Been there for some time. Resolving FIXED.

spam wrote:

Please mention where? Becuase I sure in the heck don't see anything for it
anywhere.

robchur wrote:

It's configured during MediaWiki installation, in the email options section.

(In reply to comment #7)

It's configured during MediaWiki installation, in the email options section.

Yes.
see also switch $wgEmailAuthentication and documentation (see
http://meta.wikimedia.org/wiki/Enotif )