0

I am wondering if it's safe to send the signup, reset password, 6 digit verification code in the subject of the email.

Example: "Welcome to the Application, Your verification code is XXXXXX"

The purpose of sending the verification code in the subject is to make it easily accessible on mobile devices. Instead of opening the email, a user can simply see the code from the notification.

But with that, the verification code can be shown in the list of the emails. What are some other security risks here?

Real-life attack scenario: I am on a screen share call with my Boss, I know he intentionally enabled email push notifications on Desktop. I know the service he is using exposes the password reset verification code in the subject of the email. I try to reset there password via email. They receive a notification showing the 6 digit code. I quickly do what's currently going on your mind and 💥

1
  • 5
    I think you have answered the question with your scenario. This would be unsafe, since it is vulnerable to both intentional exposure, like you describe, and accidental exposure.
    – Anders
    Sep 10 '20 at 16:17
2

Yes, this is a risk. You shouldn't send it in the subject of the email.

Think of a locked phone but you receive an email with the subject "Your code is 123456-789". That would appear on your phone's lock screen so an attacker can easily see the code (just an example here).

1
  • Some body content is also displayed in the lock screen as well.
    – Heng Ye
    Sep 11 '20 at 18:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.