So, yesterday I needed to sign & scan some forms for my bank, a credit union. Nothing hugely confidential, except it has some account numbers on it. But still, I was a bit concerned, so the exchange, with my fairly senior advisor, whom I would not suspect to be IT savvy besides showing Powerpoints, went like this:
will this be secure, via email?
bank: yes, we use secure email, as per our IT department. My assistant will be sending you a link to a login page where you can enter your credentials.
a link? you realize that this is precisely how phishing works? a login URL. No one advocates this in the IT security field. I know I'm getting this now, so I know this one is safe, but what about next week?
bank: (some variation of our IT dept says and what the heck do you know?, politely phrased)
OK, so I get the email, enter a password on their site and save the url so that at least I don't need to get it off the email the next time:
https://securemail.xxxyyyzzz.com/securereader/inbox.jsf
The web mail client is crappy so even though I replied with the forms, it shows nothing in the outbox. So, replying to the original, non-secure email, I asked if they received the secure reply, as it didn't show.
The answer? via secure email + url link, of course.
Errr, no great need to reply securely about this, but OK, I can test my login from my password manager.
As I write this, it seems to work now, but the first time it said something about an expired session, so I had to go back and actually use their second email's link:
Their plain email notifications say something like:
This is a secure message.
Click <some url here> by 2020-09-25 08:05 PDT to read your message.
After that, open the attachment.
the actual URL is something like https://securemail.xxxyyy.com/formpostdir/securereader?id=6pBzH9H9DbMMP2ALTFKr9DOXN7pcxxxx&brand=1c64710yyyy
So my question is: are these shenanigans, and especially the apparent insistence of me using login URLs from emails, in any way best practices? Seems to me, it would be much more secure if they made the email link accessible, still with an extra password, on their actual online banking site. Then they could say, not email, when you login, pick the Your account/Secure email item on the top right. Or something to that effect.
And the session expiry mechanisms, if they exist should not interfere with storing the secure URL in a password manager, as opposed to needing to pick it up from incoming emails. I assume it's cookie-based as, even after shutting down my browser, I was able to login from my password manager after following the 2nd login URL.
I totally understand there is no risk at this point in time. We are in an ongoing set of transactions that have a phone component and those emails are not unexpected. I know my advisor's voice and she knows mine.
My concern is that this is training their average users to follow URL links in emails, leading to login pages for their banking with this institution.
Am I correct in finding this is not exactly best practices?
