0

One mechanism for inviting a user to join a community in which private, personal information is to be shared is to generate a time-bombed (5-15 minutes) confirmation link with a string generated with a secure random number generator and email an invitation message to the invitee with this link. For example:

Hello! You've been invited by ____ to join ___. Visit mysite.example.com/confirm/Ip10QEUECfkw2XFTSvzt88oj to join.

I can implement this by generating the link server side and sending the email server side. The link in this case is never exposed to the sender, ever, and is only (1) stored in the invitations table in the database, and (2) appears in the email, sent by the server (Amazon SES for example).

My question is: can a client securely send this email with its native email client? I've been told a lot of systems do this, and that the invitation email, with the secure link exposed, goes into the "Sent Items" folder on the client's email app! This strikes me as bad because it seems that client-generated links that the server has to know about expose too much. Why not take the sender out of the picture completely?

Is the generation of an invitation using a native client email okay? Seems it relies entirely on the expiration of the link for security. Is this an acceptable trade off of security for convenience? If it is not okay, why do folks do this?

  • I don't understand why it's bad if the user sending the link have this link on its own Sent folder... – ThoriumBR Jun 19 '18 at 18:18
  • @ThoriumBR - if you're emailing the link to verify the email address, giving the user access to the link via a side channel means they can use the link without proving that they have access to the mailbox. See my answer below... – Neil Smithline Jun 19 '18 at 18:33
  • @ThoriumBR Well let's say I'm not really your friend but I know your email and I "invite" you. The link goes into my sent items folder. I see this link and click on it (before you do) and I've now signed up with your email. Now you can recapture your account through the forgotten password flow but I will have been able to post things on your behalf.... (Maybe there is a way around all that, but that's why I think some damage can be done.) – Ray Toal Jun 19 '18 at 18:44
  • And you really want to use email? @ThoriumBR is questioning other options. See the discussion in the answer below. – Neil Smithline Jun 19 '18 at 18:46
  • Happy to go with other approaches; I just don't know what they are. I guess the safest way might be to phone the person and say "will you please sign up with this service in which I have personal information to record/share/discuss?" but then again I think somehow email would be involved because the person signing up would use an email/password (or Oauth) and have to validate their email via a confirmation of some sort? Maybe it is time for a different question? – Ray Toal Jun 19 '18 at 18:55
1

First, email is not secure. If you need strong security, you can't use email. Email can be sent on the wire unencrypted, it is unencrypted by interim mail servers, and potentially stored in the clear in the user's mailbox. You can google or look on this site for more info about email security.

So let's assume that you decide you can live with the insecurities of emails...

Typically the point of sending a verification email is to verify the user's email address. You cannot do this from the client as the user will be able to capture the link and use it without proving that they have to the email.

In short, I see no point in emailing the link from the client. Either you don't need to verify the email address, in which case don't bother with the email. Or you want to verify email address, in which case you must send the email from the server.

  • I think OP would like to use something like tinychat.com chat, and want to send a link securely to the other party, – ThoriumBR Jun 19 '18 at 18:34
  • I'm not sure why you think that @ThoriumBR. The OP didn't suggest something like that. The post says send this email with its native email client. The words native email client don't seem like an online service. Do you read it differently? – Neil Smithline Jun 19 '18 at 18:40
  • It's because of inviting a user to join a community. I usually did this to discuss something not private with a client, or a friend, using tinychat. If the Community Service supports creating meeting rooms on-fly, this could be used. – ThoriumBR Jun 19 '18 at 18:43
  • "Community" was too strong of a word. I meant a "small group or team within a larger ecosystem" but within a team very private details can be shared. And yes the overall point is that we verify the invitee's email. – Ray Toal Jun 19 '18 at 18:48
  • 1
    If you want to verify their email, then you must email from the server. Nothing else will do it. – Neil Smithline Jun 19 '18 at 19:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.