0

When sending web application users a reminder email, is it reasonably safe to include a link in the email to take them to the web application sign in form whereby the link has their username as a parameter? This is to save the user having to enter both their username AND their password.

Our team's current thinking is this should be fine so long as the password used is of sufficient length and complexity.

3 Answers 3

2

I can't see any problem with including the username within the email.

However, it's generally considered bad practice to include a link to a login form in an email as it trains users to click through links given in an email which may be phishing attacks. Secondly, it may make your (actual, legitimate) email look like phishing/spam to some filters and/or skeptical users as in this article by Sophos.

Best practice is to tell the user to type in your address at the url bar; this ensures that the user actually goes to your website and none other.

1

Usernames are generally not considered sensitive information, as there are usually many ways for an attacker to learn them. As such, including a username in a link for the purpose of pre-filling a form isn't a security risk.

0

I would think it's as safe because the only way someone could get to the emailid in the link is by intercepting the email. If they have been able to intercept the email and read it, they can anyway get the email id from the email (To field). I don't see that much relation between this and password complexity or length.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .