I've noticed a trend in how big companies (Amazon, Skype, and a few others I don't remember in particular) handle e-mail authentication.
Rather than e-mailing clickable links with some single-use token, they've switched to short/readable security codes, which the user is expected to manually highlight, copy, and paste into a textfield on the page.
I can think of two motivations behind this change:
- A clickable link causes a "discontinuous" user experience. The user navigates around on one page, causes a recovery e-mail to be sent, but clicking the link opens a new tab while the previous one still lingers
- For security: to train users not to click links in e-mails sent by these companies
Is it one of these two reasons? Is it something else? Is there any literature that compares the two techniques?