Is there any security benefit from emailing a "secure link"?

Question

Sometimes I receive email messages from organisations I'm involved with saying something like:

Alice at AnyCo has sent you a secure message

Along with a link to access said message. Sometimes I'm then asked to create an account. The last one even decided to use "2FA" and send me a code to the same email address before I could log in. The companies which provide this service (for example Kiteworks) seem to act like it's the responsible way to send documents.

My impression is that this amounts to "security theatre" and does nothing to prevent unauthorised access to the file by third parties, or tampering with the contents of the file, compared with simply sending an attachment. That is usually what is implied by these services.

Answer 1

It provides some benefits in that the sensitive contents are stored on the server, rather than in the body of the email. This means that the link can be revoked to block access (for example, if the email was sent to the incorrect address) - whereas once an email has been sent, there's no reliable way to recall it.

It also allows the file sharing platform to implement some additional security controls (such as IP restrictions, or only allowing federate authentication) - so the link by itself might not have any value if an attacker can't reach or authenticate on the site.

But in a lot of cases, it is just security theatre (especially if the "secure" platform doesn't enforce conditional access, MFA, risky login detection, and all the other security features that the email system does). It also trains users to click links in emails and then enter their credentials, which is obviously a very bad habit to get into. A lot of the time, these "secure" platforms are used for compliance reasons, rather than because they're addressing a realistic threat.

Answer 2

The SMTP protocol is intended to exchange data in clear text over possibly a number of relays. In addition to the common data interception attacks, each and every relay could examine the message (and if found important keep a copy of it). Furthermore, many end users do not own their own mail server, so the message is kept (still in clear text) on their mail provider server.

And all those attacks cannot be detected, either by the sender of by the receiver.

In contrast when only a link is sent, the message is only kept on the sender server, and is (normally) downloaded through HTTPS and because of that cannot be easily intercepted.

That being said, as the link is sent in a simple mail, the link itself can be intercepted and an attacker could use it to steal the sensitive data. But at least if the real user also uses the link, the sender could detect 2 different connections and be aware of the attack.

The correct way would be to securely identify the recipient before a message is sent there. This is commonly used by banks: they send a rather innocent message with that simple information: a message is available. Then the user has to use its account (along with a secure connection way) to download the message.

---

BTW, the really secure way would be to use X509 certificates. That way S/MIME allows to send a signed and encrypted message that only the real recipients will be able to decrypt. But unfortunately, X509 certificates are seldom used outside closed organizations...

Answer 3

Not only do these things lack any significant security benefit. One thing that's underappreciated is the strong security disadvantage and imbalance of power it creates against the recipient. They have no means of ensuring the document behind the "secure link" is the same as it was at the moment the email arrived and that it has not been alterred by the sender or some third party with access to the "secure document" platform between the time the email was sent and when they read (or later re-read) it. If the document were included as an attachment, the recipeint would possess a permanent copy from the moment of receipt, and depending on how DKIM was used, possibly even a cryptographic signature establishing authenticity/non-repudiation of the document.

As noted by bta in the comments, another way these things harm the recipient's security is by bypassing any scanning for malware, etc. that would be done for direct attachments but not for off-site links. And as ThoriumBR seems to have suggested, these kinds of "secure links" may train recipients to get phished - by normalizing following links to documents and possibly entering private information or performing authentication processes with the site.

Answer 4

As weak as it is, you need to consider that the intended recipients are in majority layman with little security or computer knowledge. You cannot expect them to install and use PGP or similar more secure interactions; they are already stretched by a link with a code in a second email.
Under the circumstances, those companies try to do the best possible within these limitations. Is it secure? No. But better than a single email.

Answer 5

Another factor here--this approach greatly reduces the risk of casual discovery of the information.

If my doctor sends a message saying "you have a message on the portal" someone who picks up my phone can't read the actual medical info. There are times I wish they would permit us to turn down the security a bit--please include the merchant in credit card transaction e-mails!--but the idea is sound.

Also, in the real world the technically literate sometimes end up seeing mailboxes of their illiterate friends. Yeah, in a perfect world they would always do their own logins, a tech would never mess with their equipment. We don't live in a perfect world.