0

Someone sent me a Starbucks gift card. The email contained a redemption link, and that redemption link ended in a long secure hash, much like those on github secret gists.

Clicking the redemption link took me to a page with a single form field, asking me to enter the email address the link was sent to. After entering my email, I was taken to a page showing the image equivalent of a gift card with the protective coating scratched off -- a credit-card-like number which, when entered or scanned into the starbucks app, credits your account with money. That number, I believe, could have been entered by anyone to claim the cash.

My question is: Why ask me to confirm the email address? Does that provide any additional security beyond the hashed link itself? It seems to me the security is provided by the hash link, and if that link was compromised then in all cases my email address would be compromised too (eg, if someone had hacked into my email account, or read the email in transit).

Of course, in theory it is preventing a brute force attack from someone randomly guessing hashes, but the search space is so massive that it seems like an unnecessary precaution assuming the hash has been generated securely.

Improve this question

1 Answer 1

Reset to default
1

As far as I can tell, the idea is that even if the URL is leaked to somebody who's not you, your gift card is still protected.

Sure, it's fairly rudimentary especially since email addresses are by no means private, but generally theft of Starbucks gift cards isn't something a lot of people who could easily bypass the email validation would take part in.

And it probably makes people who aren't very security minded feel more secure.

Improve this answer
4
  • Can you think of a scenario where the URL is leaked but my email address is not?
    – Jonah
    Jun 23, 2014 at 4:39
  • @Jonah you copy the URL and accidentally paste it on Facebook? I mean, I've done that before with passwords and IRC. And like I said, it seems to be more of a facade of security than actual security... most people won't know that the hashed URL is actually a security feature.
    – Eric Lagergren
    Jun 23, 2014 at 4:41
  • yeah, i think your "security theatre" angle is right on. that makes the most sense. facebook example is a little thin :) -- and most of your facebook friends would know your email -- but i suppose it's always possible.
    – Jonah
    Jun 23, 2014 at 4:44
  • Haha, it might be a little thin depending on who you're friends on Facebook with!
    – Eric Lagergren
    Jun 23, 2014 at 4:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .