Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

When you ned to confirm that an email address belongs to a certain visitor to your site, would it be insecure to do it as follows:

  • When the user visits your site, you give them a session token as a cookie, and send them a confirmation email
  • Within the email is an image, hosted by your site.
  • The mail also contains a confirmation link, with the message 'if you don't see an image, please click the link below.
  • When the browser sends a request for the image, you check if the request contains the cookie you gave before sending the confirmation email, and if there is such a cookie, send back the image.

This makes it easy to confirm your e-mail address without clicking a link in the e-mail.

Just like any other email confirmation system, there is still also some token in the confirmation link, or the image source.

so, is this still secure?

share|improve this question
The simple answer is no - it is not secure. However it may be secure enough for your purpose. –  Rory Alsop Oct 4 '13 at 12:20
It also assumes a web-based email client, which you're accessing using the same browser as the sign-up page. Use Thunderbird (or be checking your secondary email in an Incognito window), and this will simply fail. –  cloudfeet Oct 4 '13 at 16:01
that's why I'd provide the link as a fallback. –  bigblind Oct 4 '13 at 21:19

1 Answer 1

up vote 2 down vote accepted

Ah, but the user is "clicking a link in the email". It just is an "automated click". The danger in "clicking a link in the email" does not come from the physical action of pushing the button, but from the downloading of data from a link found in the email. If this downloading occurs automatically, the risk is not reduced; quite the contrary, in fact. Most emailing software offer, at least as an option, a possibility not to automatically download pictures; this is an improvement because it, at least, gives a way for the user to prevent the download to occur (namely, by not clicking).

In that sense, your proposal is equivalent to a click-in-email system, and shares the same security issues. At best, it improves user experience, in that it removes the physical click in the cases where the user is careless (i.e. his software follows image links automatically). To some extent, what you suggest boils down to: "yeah, user is vulnerable, but at least we can leverage his vulnerability to make his life easier; he cannot be protected, but let's fill his world with blissful ignorance instead of dread".

Now, if you take the server's point of view, the system indeed guarantees that whoever received the cookie in his Web browser is also able to read the emails sent to the specified address, since the browser followed the image link from the email. You should still make sure that the link in the email contains a non-guessable random component; otherwise, an attacker could simply get the picture by typing the link in his browser, thus simulating reception of the email. As usual, even the best security systems contain enough room to totally botch them, if implemented without due care.

share|improve this answer
I was thinking about security from the view of user identity. So, when a user registers from the site, you want to make sure that the user is actually the owner of the e-mail address. The image makes this more seamless for the user, I just wanted to make sure that the user not having to click the link anymore wouldn't create a security risk. –  bigblind Oct 4 '13 at 14:18
Well, you don't create an additional risk. But the image makes things more "seamless" only if the risk is already there. –  Tom Leek Oct 4 '13 at 14:28

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.