1

I just got an email from a financial institution in answer to a question I raised with them. It came in the form of a "secure email" from Forcepoint, which requires you to open an HTML document and click on a link contained within. The document has an encrypted block of code in it which I presume is used in the process of creating the link / communicating with the remote server.

The link then gave me a registration form to fill in including a password and security question. I generated a random password and bogus answer for this purpose as I would always do.

After that I got another link by email which gave me the answer to my original question.

The whole process had a bad smell to it, including the dodgy-looking domain names involved ("voltage-pp-0000.secure-mailcontrol.com" - really?).

What's the security advantage of this, if any? Requiring you to click on an attachment seems like a really bad idea. I only followed the instructions because the context was such that I knew it was very unlikely to be a phishing attempt and none of the information asked for would be of any use if it were.

0

Usually, Forcepoint email security would encrypt the email content outgoing when the body contains sensitive information like account number, credit card numbers, SSN's etc. On the recipient end, it would ask login credentials to view the information, so to check you are authorized to view that information. But, it is odd, that it asked you to create a password and random question without any identity validation. Are these the only things it asked for ? If not, this could possibly be a mis-configuration on their end.

  • It sent a confirmation email with a link in it which I clicked on and was then taken to a login screen. So typical registration process with email verification. Long-winded, and hard to see the advantage over a regular link in the first instance. Anyone with access to my email could replicate the process. – Alfred Armstrong Dec 6 '18 at 10:00
  • 1
    Are you sure this not a phishing email ? Did you check if it was sent from the right domain ? – SECTEST oncu Dec 8 '18 at 0:58
  • Yes, firstly because it contained my account number and birth name not obvious to a phisher, next I didn't have to supply anything useful to one, finally there was an answer to the query I had sent them. But that was my suspicion all along until I saw that answer. – Alfred Armstrong Dec 8 '18 at 13:03
0

Actually, the process is something like this. A customer would send an email to internal organization like opening an account or getting a loan etc. So, the organization would reply to the same email asking for sensitive information and necessary documents. When the outgoing email hits Forcepoint, it would encrypt and sends it to the customer outside of the organization. When the customer clicks on the link, it would prompt to create an account so, he/she can upload the necessary documents in the future. In this case, there is no client side validation for the first time because, there is no sensitive information sent from organization's end (atleast, thats the usual process). This allows customers to send documents. But, for the second email, he/she have to login to access the documents uploaded lastime and that's how it authenticates the user. Yes, anyone who received an email can create a login and access the email(which only requests for information) but, it doesn't contain any sensitive information.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.