We have a vendor who sends us "secure" messages. The messages come as an email message that contains a link to an SSL encrypted website that has the real message. There is no username/password on the linked site, or any other form of authentication as far as I can tell.
I'm sure they do this so they can check off a box on some compliance checklist, but I want to know, can this truly be considered secure?
My thinking is that since the link itself is sent in the clear, then it is no different than if they had sent the message in the email in the first place. Any attacker who might be able to gain access to my email, either at rest or in transit, can capture and then visit the link.
So is this secure, and if it is at least at some level, what security problems might it be solving? Are there other security measures, not readily evident, that they could be taking to ensure only the original recipient can use the link?
Because several answers have mentioned it. In this case there is no IP address white listing or behind the scenes proxy authentication.
Also, there is an expiration date listed on the link, but it is fairly far in the future.