Recently I had to make an appointment at a hospital. I got an email with a link with a token in the form of a GUID. This brought me to a page where I had to enter my birth date to see the details.

This detailed page contained sensitive details like my SSN, what department my appointment was for (e.g. surgery, radiology etc.) and my doctor's name.

The email was send through TLS. The link has not expired so far and I am not able to change my password.

Since my birthday is basically public information, is this scheme equivalent to sending me a plaintext password (GUID)? Or is there something that I'm missing?

Recently I had to make an appointment at a hospital. I got an email with a link with a token in the form of a GUID. This brought me to a page where I had to enter my birth date to see the details.

This detailed page contained sensitive details like my SSN, what department my appointment was for (e.g. surgery, radiology etc.) and my doctor's name.

The email was send through TLS. The link has not expired so far and I am not able to change my password (the concept 'password' does not seem to exist).

Since my birthday is basically public information, is this scheme equivalent to sending me a plaintext password (GUID)? Or is there something that I'm missing?

Recently I had to make an appointment at a hospital. I got an email with a link with a token in the form of a GUID. This brought me to a page where I had to enter my birth date to see the details.

This detailed page contained sensitive details like my SSN, what department my appointment was for (e.g. surgery, radiology etc.) and my doctor's name.

The email was send through TLS. The link has not expired so far and I am not able to change my password.

I think this method is the same as sending me a plain text password by email since my birthdate is easy to guess or find for anyone who may or may not know me personally. What do you think?

Recently I had to make an appointment at a hospital. I got an email with a link with a token in the form of a GUID. This brought me to a page where I had to enter my birth date to see the details.

This detailed page contained sensitive details like my SSN, what department my appointment was for (e.g. surgery, radiology etc.) and my doctor's name.

The email was send through TLS. The link has not expired so far and I am not able to change my password.

Since my birthday is basically public information, is this scheme equivalent to sending me a plaintext password (GUID)? Or is there something that I'm missing?