1

So, yesterday I needed to sign & scan some forms for my bank, a credit union. Nothing hugely confidential, except it has some account numbers on it. But still, I was a bit concerned, so the exchange, with my fairly senior advisor, whom I would not suspect to be IT savvy besides showing Powerpoints, went like this:

  • will this be secure, via email?

  • bank: yes, we use secure email, as per our IT department. My assistant will be sending you a link to a login page where you can enter your credentials.

  • a link? you realize that this is precisely how phishing works? a login URL. No one advocates this in the IT security field. I know I'm getting this now, so I know this one is safe, but what about next week?

  • bank: (some variation of our IT dept says and what the heck do you know?, politely phrased)

OK, so I get the email, enter a password on their site and save the url so that at least I don't need to get it off the email the next time:

https://securemail.xxxyyyzzz.com/securereader/inbox.jsf

The web mail client is crappy so even though I replied with the forms, it shows nothing in the outbox. So, replying to the original, non-secure email, I asked if they received the secure reply, as it didn't show.

The answer? via secure email + url link, of course.

Errr, no great need to reply securely about this, but OK, I can test my login from my password manager.

As I write this, it seems to work now, but the first time it said something about an expired session, so I had to go back and actually use their second email's link:

Their plain email notifications say something like:

This is a secure message.
Click <some url here> by 2020-09-25 08:05 PDT to read your message.
After that, open the attachment. 

the actual URL is something like https://securemail.xxxyyy.com/formpostdir/securereader?id=6pBzH9H9DbMMP2ALTFKr9DOXN7pcxxxx&brand=1c64710yyyy

So my question is: are these shenanigans, and especially the apparent insistence of me using login URLs from emails, in any way best practices? Seems to me, it would be much more secure if they made the email link accessible, still with an extra password, on their actual online banking site. Then they could say, not email, when you login, pick the Your account/Secure email item on the top right. Or something to that effect.

And the session expiry mechanisms, if they exist should not interfere with storing the secure URL in a password manager, as opposed to needing to pick it up from incoming emails. I assume it's cookie-based as, even after shutting down my browser, I was able to login from my password manager after following the 2nd login URL.

I totally understand there is no risk at this point in time. We are in an ongoing set of transactions that have a phone component and those emails are not unexpected. I know my advisor's voice and she knows mine.

My concern is that this is training their average users to follow URL links in emails, leading to login pages for their banking with this institution.

Am I correct in finding this is not exactly best practices?

8
  • 3
    Clicking links in emails is not necessarily insecure - in many ways that is the only way they can do business, and having you email them the documents would certainly be much more insecure. The issue is clicking on links in emails you weren't expecting. "BTW, you're going to get an email in a second, please click the link to upload your documents" is not at all concerning when the email shows up a moment later. There are certainly still ways that can go badly, but it's a better solution than many. – Conor Mancone Aug 26 '20 at 16:29
  • 1
    "they could easily put the login on their site" -- you have no idea if that is true. Account access and file upload are the kinds of functions that could stand to be separated, and if the bank is old, they like have cobbled together a number of different systems together. And it sounds like they are using a "one time link" design pattern, which is best practice in many scenarios. – schroeder Aug 26 '20 at 16:56
  • 1
    @ConorMancone: On the other hand it's easy to call someone, pretend being from their bank, and then send the phishing email. It's indeed better to call and inform the documents are ready to be signed when you login to your web banking. – Esa Jokinen Aug 26 '20 at 17:13
  • 1
    @ItalianPhilosophers4Monica You've misunderstood one part: there isn't one link. There is an id in the link that is specific to you, on top of the password. Note that the id is 32 characters long. Do you expect them to read you that over the phone? Them sending you the link in some way is a requirement and is actually a good one. – Conor Mancone Aug 26 '20 at 17:26
  • 1
    @EsaJokinen that only works if I as an attacker know that the person is actively working with the bank. The OP was already talking to the bank and so sending along documents is expected. If I just called someone up randomly and said, "Hi, this is your bank, I need you to click this link and fill out the documents" it's going to be a different phone call. I didn't say that the bank randomly sending you links is a good idea. However, it's reasonable and likely the only solution in many cases, when you are actively communicating with your bank on known channels and are expecting it. – Conor Mancone Aug 26 '20 at 17:30
2

You ask about best practice.

Best practice would be to have you use your normal account login on the normal website and select a "submit forms" option from there which takes you to an upload page for submitting your scans.

For your experience

The pre-arranged link via email method is slightly less secure, but the exploit window is narrow.

Assuming your bank's domain name is represented by xxxyyy.com using the domain name securemail.xxxyyy.com submission is good form. the poor user experience on that domain is just poor UX, not inherently insecure.

But yeah. the over-all user experience (starting with the phone conversation) trains users to trust links in emails. and this seems to have the potential to harm the bank, and its customers.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.