0

Recently an organization I forgot to update credit card details had my renewal payment fail because I forgot to update details. They sent an email as below which had a direct link to a web form without any instructions to check authenticity. I think this is bad practice because it trains members to blindly accept direct links to update details which are similar to phishing emails.

I know this reduces membership renewal (as every additional step discourages signup as people are busy) but the email should ask users to go to the website from bookmarks or manually enter it in or ask users to internet search the organisation names (although this also has issues with scammers advertising scam websites).

The organisation's counter-argument was that a hypothetical nefarious cracker could put false instructions anyway.

What's best practice in this regards? Am I being too strict or nit picking?

Membership Payment Failed at <organisation>

The current subscription payment for your <organisation> membership has failed. Please click the following link to log in and update your billing information to avoid account suspension. https://<org domain>/wp-login.php?redirect_to=https%3A%2F%2F<org domain>%2Fmembership%2Fmembership-billing%2F

Account: <my username> (<my email>)

Post Updated.

Improve this question
5
  • "without any instructions to check authenticity ... cracker could put false instructions anyway." - that's a fair point, and this is what attackers also actually do. If you expect instructions in the mail, then you run into the same problem - how can you make sure that the mail actually comes from the expected sender? The common recommendation is that you visit the organizations site without any links but from what you know the site is (i.e. bookmark...). Then login there and update your information.
    – Steffen Ullrich
    Commented Jul 19, 2022 at 6:05
  • I'm aware of that recommendation but it has friction. Is that unavoidable?
    – Darryn Brisdaz
    Commented Jul 19, 2022 at 10:21
  • One somehow needs to have an established trust to build on, which is both secure, easy to understand for the user and hard/impossible to fake by the attacker. Several mechanisms like signed mail (S/MIME) offer the first (secure) but are to hard to understand for many users and that's why also often easy to fake by an attacker (if the user is not fully sure what exactly to look for the attacker can trick them).
    – Steffen Ullrich
    Commented Jul 19, 2022 at 10:38
  • Please don't add "Post Updated." at the end of the question - it adds no value (no information about what was updated and why). It can be seen from the information below the question that it was updated and contrary to just mentioning "post updated" it can even be seen there what exactly got updated.
    – Steffen Ullrich
    Commented Jul 19, 2022 at 10:42
  • Security, almost by definition, increases friction. It's all a decision about what tradeoffs are worth making.
    – Bobson
    Commented Jul 19, 2022 at 13:27

1 Answer 1

Reset to default
3

Just take the link out of the email. Something like:

The current subscription payment for your membership has failed. Please log in to your account and update your billing information to avoid account suspension.

Improve this answer
3
  • I've updated my question - I know of that solution but it causes friction. know this reduces membership renewal (as every additional step discourages signup as people are busy) but the email should ask users to go to the website from bookmarks or manually enter it in or ask users to internet search the organisation names (although this also has issues with scammers advertising scam websites).
    – Darryn Brisdaz
    Commented Jul 19, 2022 at 10:22
  • If it's not your decision, all you can do is to present your argument, and then get someone higher up to sign off that they're happy to accept the risk. If the organisation decides that the cost of losing some percentage of renewals is greater than the cost of the your users being more likely to get phished (including the reputational damage to your company) then that's their decision - just make sure that you've got a paper trail to cover your arse.
    – Gh0stFish
    Commented Jul 19, 2022 at 11:52
  • Yep and that's what I'm hoping the infosec community can help me explore.
    – Darryn Brisdaz
    Commented Jul 19, 2022 at 20:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .