I've noticed a trend in how big companies (Amazon, Skype, and a few others I don't remember in particular) handle e-mail authentication.

Rather than e-mailing clickable links with some single-use token, they've switched to short/readable security codes, which the user is expected to manually highlight, copy, and paste into a textfield on the page.

I can think of two motivations behind this change:

  1. A clickable link causes a "discontinuous" user experience. The user navigates around on one page, causes a recovery e-mail to be sent, but clicking the link opens a new tab while the previous one still lingers
  2. For security: to train users not to click links in e-mails sent by these companies

Is it one of these two reasons? Is it something else? Is there any literature that compares the two techniques?

  • 1
    Or it might just be to make sure that no automated system is clicking the link - various threat protection systems scan mails for links and follow these automatically. Of course, this could probably be prevented by checking that the browser fingerprint is the same as from the original browser which resulted in this mail. – Steffen Ullrich Apr 2 '19 at 10:39
  • Ah, that makes sense too – Alexander - Reinstate Monica Apr 2 '19 at 11:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.