How secure is an Activation Email?

Question

Is there any risk to an Activation Email?

My ASP.NET Site is set up so that a user has to check their Email and click an activation link which is made of a GUID created as their user ID in the SQL Membership Tables.

There is a third party application that holds an Email, a not so secret 4 digit ID Number for each potential user, so the user must use this Email and ID together in order to register an account, the account is not "approved" until they activate their account using the link in the Email sent to this Email. only employees can set the Email and ID in the third party application.

This site handles signing up for an Email Subscription of semi-privileged information, this site doesn't actually handle the emailing of the semi-privileged information.

Other than Social Engineering, what is the risk associated with this set up for user registration?

Answer 1

"How secure is X" is always a vague question. In order to give you a better answer, we need to understand the value of what you're trying to protect, and your threat model.

Are you trying to protect a banking or shopping site, where people can store credit cards for future purchases? You'll have determined thieves like you can't imagine, and this isn't nearly adequate. You likely have more security issues than the few paragraphs of advice you'll receive here.

Are you trying to protect a shopping site, where people can browse, set up wish lists, fill shopping carts, and write reviews; but don't pay on your site? What do you think the hackers might find valuable? Could they re-route purchases to some other location where they'd be stolen? It might be OK, but you should think about incorporating another factor, such as a security question, SMS message, requiring a physical visit to a cashier, etc.

Are you trying to protect the comment section of your blog, and your primary concern is an army of smurfs posting spam-filled links? It should be adequate.

Are you posting a private gallery of pictures for friends and families? It's probably overkill.

Think about your perceived threats and vulnerabilities, in terms of attackers and their motivations. Then come back here and clarify your problem statement a bit more, and improve your question. If you haven't already figured out the answer on your own, we'll still be here.

Answer 2

Using only their username to generate the GUID is not sufficient, how about adding a time stamp to it?

There should be a time limit to which the user has to click the link. The link should also expire upon account activation, especially if they are required to set a password upon account activation.

What if I am able to obtain the activation link, is the four digit code protected by some sort of rate limiting? This in order to prevent the 10000 requests to guess the four digit ID.

Answer 3

The main problem is that e-mail is not a secure distribution mechanism and is potentially susceptible to intercept. It is unfortunately often the best we have available for trying to validate a user has access to the e-mail box, but shouldn't be trusted exclusively.

Many e-mail servers make no attempt to protect the contents of an e-mail in transit and any computer or router in the path of the e-mail can read the messages. Anyone with access to that path, either through being an ISP or through a virus on the users computer could access the contents of the e-mail.

Additionally, unless the e-mail goes to an SSL secured website, it would be possible for an attacker to spoof the page and intercept the GUID on the way back to your server as well.

Most likely the user will be the person who actually owns the e-mail address, but you have no guarantees of that.