Someone sent me a Starbucks gift card. The email contained a redemption link, and that redemption link ended in a long secure hash, much like those on github secret gists.
Clicking the redemption link took me to a page with a single form field, asking me to enter the email address the link was sent to. After entering my email, I was taken to a page showing the image equivalent of a gift card with the protective coating scratched off -- a credit-card-like number which, when entered or scanned into the starbucks app, credits your account with money. That number, I believe, could have been entered by anyone to claim the cash.
My question is: Why ask me to confirm the email address? Does that provide any additional security beyond the hashed link itself? It seems to me the security is provided by the hash link, and if that link was compromised then in all cases my email address would be compromised too (eg, if someone had hacked into my email account, or read the email in transit).
Of course, in theory it is preventing a brute force attack from someone randomly guessing hashes, but the search space is so massive that it seems like an unnecessary precaution assuming the hash has been generated securely.