5

Our communication department recently asked us (the security team) a question. They send out a lot of mail, especially mails like 'your password is set to expire' are hot topics here. The question was: Should we write out the links? We have 'domain.com/passwordreset'. Should we add 'www'? Should we add 'https'? Should we just make it a link of text 'Click here'?

I checked some email I personally got from banks and noticed that it is usually a string that then contains a link, but those companies do that because they want to track who clicks the links and the links are thus really long. The URLs our communication department is trying to communicate are short URLs that they would love for people to remember outside of the email as well.

I looked around, but could not find any practical experience with this online. So my question is: What would be the 'best' option and why?

  • Good question, but the accepted question is bad. Don't teach users to click on links in emails! Accept the answer by Teun Vink instead. – nealmcb Sep 10 at 2:22
0

The most important thing is to make sure that people actually change their passwords, so making it as easy as possible to click on a link and remember it afterwards is important. First, you should definitely make it an https link, you should never point people down an insecure connection to change a password.

As for the format of the data there's no particularly right answer, you could just hide the link behind text like "Change Your Password" a la:

<a href="https://www.example.com/passwordreset">Change Your Password</a> which would look like this: Change Your Password

or you could have a bare link

<a href="https://www.example.com/passwordreset">https://www.example.com/passwordreset</a> which would look like this: https://www.example.com/passwordreset

Most browsers and email programs automatically recognize links whether they are wrapped in html or not, for example I've simply typed https://www.example.com/passwordreset in, but most browsers will show a link.

Most users do not memorize links to be honest and won't remember your password reset url, some might though, so if that's an important goal putting the bare link in makes sense.

  • www.mysite.com is a real domain (apparently associated with a web hosting company). Please use the domain names explicitly reserved for the purpose for examples unless you really do intend to point people at a real-world site. I have a summary of these available on my personal web site (I made it because the relevant information is spread out in various RFCs and I grew tired of always looking around): Internet names and networks reserved for examples and documentation – a CVn May 3 '17 at 9:50
  • Also, mind you, browsers don't automatically recognize links in text. (Many e-mail programs probably do, though.) If you look at the DOM, you'll see that the "bare" link has been surrounded by a <a href=""> tag. – a CVn May 3 '17 at 9:51
  • I didn't realize that mysite was used @MichaelKjörling ! I'll keep that in mind for the future. – GdD May 3 '17 at 10:17
  • Asking users to click on links is generally bad advice. The answer by @teun-vink is much better. And furthermore, NIST advises against expiring passwords: "Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically). However, verifiers SHALL force a change if there is evidence of compromise of the authenticator." pages.nist.gov/800-63-FAQ/#q-b5 – nealmcb Sep 10 at 2:19
3

A policy I've seen used by some banks and government agencies in the Netherlands is never to include any links in mails, but just to refer to "our website" or "our webportal".

The main idea here is that they're explicitly telling customers never to click on any links in emails (supposedly) coming from them. This way they hope to reduce the chance of people visiting links mentioned in phishing mails and entering their credentials there.

People are always forced to enter the URL of the webpage in their browser (or use bookmarks), which can be a bit of a drawback looking at it from an UX perspective, but it can work as a security measure.

Unfortunately, I have no idea how effective this is, and thus if it's a useful strategy.

  • They only seem to do this in cases of mails like password resets and not informative overall mails like "New mortgage rates", there links are a thing. I also live in the netherlands. – saekort May 3 '17 at 10:22
  • 1
    I can agree. A user can never check if a link is legit. It might still be an address with homoglyphs – BlueWizard May 3 '17 at 16:21
0

As others have stated, there is no way to provide a guarantee to your users that the link they find in you mail is safe: while there are usually some easy way for users to check where a link will lead them, it's impossible to automate that remotely: you'll have to trust the screening done by the mail client.

There are, however a few things you can do to improve the overall situation:

  • NEVER use URL shortening services (TinyURL, etc.)
  • Implement proper origin control on you outgoing email: properly setup SPF and DKIM will make it harder to spoof emails from you and therefore will make it easier for your users to trust mails from you (not guarantee, but it's much better than nothing).
  • Always send mails from the same domain. This should also include marketing email. This makes it easier for the user to spot phishing attempts.
  • If you can, digitally sign ALL your emails (through S/MIME) with valid X509 certificate. Sadly, there is (AFAIK) no equivalent of hsts for SMTP or email in general. You can, however, include a disclaimer in all your messages about the fact that all outgoing message should be signed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.