User-provided phrase to verify email sender- Is this a good idea?

Question

Signing up for a medical records service today, in addition to security questions (sigh) I was prompted with a field that read:

Security Phrase for Email Messages:
Your security phrase will be included with all email communications to verify that you received the email from <service> (this is not your password or security question answer) Example: I love chocolate. My dog's name is Toto.

I've never seen this anywhere before and couldn't find anything on it online (maybe I wasn't using the right terms). The reasoning seems to be that only will know your security phrase and seeing it in an email will verify it, because a phishing attack won't be able to duplicate it.

On the other hand, it seems to me not much more useful than security questions and may even train users to not use other methods of verifying incoming email.

Is this kind of thing a good way to verify emails from a service? Would it help prevent phishing attacks?

Answer 1

This is an extension of the advice on how to verify emails from authorized senders. Usually, you want to see some sort of info in the email content that is not generic or public knowledge. This verification phrase takes that one step further.

It seems like a fine way to provide tools to users to better verify incoming emails.

Answer 2

Seems to be a poor man's digital signature replacement. The medical service probably doesn't trust its users (ie. their ability to handle proper digital signatures) therefore a simplified version was implemented using shared secret.

Obviously it's much worse solution compared to signatures. After analyzing single message all subsequent messages can be spoofed, but at least it's harder to do en-masse.

In my opinion, it's futile attempt to replace the proper method. Users who are not security aware, won't understand what are the implications of missing security phrase. Presence of personal information may increase trust level, but its absence won't lower it. One may even consider it harmful and dangerous because it creates an illusion of security. A determined attacker could easily extract the "security phrase" from unencrypted mails (anywhere in the mail chain) and including it would greatly increase the efficiency of spear-phishing attacks.

Using proper DMARC, DKIM, strong restrictive SPF field and preferably proper digital signature would be much better (in an ideal world).