I recently signed up for a webpage. When I opened the customary "click this link to validate your email and pick a password" email my client notified me that the sender had requested a read receipt. I opted not to send one, and could complete the sign up anyway.

I was a bit surprised, since this has never happend to me before on a similar email. Being of the curious kind, I started to speculate why they request receipts, and how they could be used to enhance security. Maybe it is related to token invalidation, but how?

I fail to understand how they could be used. Perhaps you have any ideas?

  • This is the term used in Microsoft Outlook so I would assume it to be the correct term. – Topher Brink Oct 7 '16 at 12:15

The only way I can think of this improving security is that any links/tokens get revoked sooner.

Example: with an password reset email the token may be valid for 1 hour, if a read receipt is received after 6 minutes it would be reasonable for that token to only be valid for another 5 minutes. This reduces the attack window from 1 hour to 11 minutes.

  • This seems like a very narrow benefit to me - it only protect in the case where the user opens the email but do not click the link, which doesn't seem so likely to me. But since nobody has come up with any alternative explanation I assume that is the reason. – Anders Oct 29 '16 at 8:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.