Best practices communicating links in email

Question

Our communication department recently asked us (the security team) a question. They send out a lot of mail, especially mails like 'your password is set to expire' are hot topics here. The question was: Should we write out the links? We have 'domain.com/passwordreset'. Should we add 'www'? Should we add 'https'? Should we just make it a link of text 'Click here'?

I checked some email I personally got from banks and noticed that it is usually a string that then contains a link, but those companies do that because they want to track who clicks the links and the links are thus really long. The URLs our communication department is trying to communicate are short URLs that they would love for people to remember outside of the email as well.

I looked around, but could not find any practical experience with this online. So my question is: What would be the 'best' option and why?

Answer 1

The most important thing is to make sure that people actually change their passwords, so making it as easy as possible to click on a link and remember it afterwards is important. First, you should definitely make it an https link, you should never point people down an insecure connection to change a password.

As for the format of the data there's no particularly right answer, you could just hide the link behind text like "Change Your Password" a la:

<a href="https://www.example.com/passwordreset">Change Your Password</a> which would look like this: Change Your Password

or you could have a bare link

<a href="https://www.example.com/passwordreset">https://www.example.com/passwordreset</a> which would look like this: https://www.example.com/passwordreset

Most browsers and email programs automatically recognize links whether they are wrapped in html or not, for example I've simply typed https://www.example.com/passwordreset in, but most browsers will show a link.

Most users do not memorize links to be honest and won't remember your password reset url, some might though, so if that's an important goal putting the bare link in makes sense.

Answer 2

A policy I've seen used by some banks and government agencies in the Netherlands is never to include any links in mails, but just to refer to "our website" or "our webportal".

The main idea here is that they're explicitly telling customers never to click on any links in emails (supposedly) coming from them. This way they hope to reduce the chance of people visiting links mentioned in phishing mails and entering their credentials there.

People are always forced to enter the URL of the webpage in their browser (or use bookmarks), which can be a bit of a drawback looking at it from an UX perspective, but it can work as a security measure.

Unfortunately, I have no idea how effective this is, and thus if it's a useful strategy.

Answer 3

As others have stated, there is no way to provide a guarantee to your users that the link they find in you mail is safe: while there are usually some easy way for users to check where a link will lead them, it's impossible to automate that remotely: you'll have to trust the screening done by the mail client.

There are, however a few things you can do to improve the overall situation:

• NEVER use URL shortening services (TinyURL, etc.)
• Implement proper origin control on you outgoing email: properly setup SPF and DKIM will make it harder to spoof emails from you and therefore will make it easier for your users to trust mails from you (not guarantee, but it's much better than nothing).
• Always send mails from the same domain. This should also include marketing email. This makes it easier for the user to spot phishing attempts.
• If you can, digitally sign ALL your emails (through S/MIME) with valid X509 certificate. Sadly, there is (AFAIK) no equivalent of hsts for SMTP or email in general. You can, however, include a disclaimer in all your messages about the fact that all outgoing message should be signed.